Security & Encoding
Password Strength Analyzer
See how a password holds up: length, character mix, repetition and estimated crack time under common attack scenarios. Everything is analyzed in your browser — the password never leaves the page.
Password
never sent anywhereAnalyzed locally with JavaScript. Nothing is uploaded, logged or stored.
Strength
live—
Enter a password to see how it holds up.
—
Estimated time to crack
Analysis
- Length
- 0
- Character pool
- 0
- Entropy (bits)
- 0
- Estimated guesses
- 0
- Unique characters
- 0
- Character mix
- none
No password entered.
Feedback
Warnings
No warnings yet.
Suggestions
Suggestions appear as you type.
How it works
The analyzer estimates the character pool from the character classes present, multiplies by length to get a base entropy, then discounts repetition, keyboard and alphabet sequences, dates and common passwords. Crack time divides the estimated number of guesses by the guess rate of the selected attack scenario. Estimates are a guide, not a guarantee — no password is ever transmitted.
Practical uses
Estimate a password's entropy from its length, character classes and detectable patterns, then show a five-level score and crack-time estimates for several guessing scenarios.
Common ways to use it
- Check whether a candidate password is long and varied enough to use.
- See how a predictable suffix or a keyboard row lowers the estimate.
- Compare the same password under throttled online guessing and fast offline guessing.
A common password with a predictable suffix
Input
Password: P@ssw0rd2024 Scenario: Offline, fast hash (about 10 billion guesses per second)
Output
Strength: Very weak (score 1/5) Entropy: about 14 bits Character pool: 95 Crack time (offline, fast hash): less than a second Warning: This is a common password with a predictable suffix.
Verified with the tool's analyze function. The base word p@ssw0rd is in the built-in common list, so the estimate is capped at 14 bits. The same tool rates "correct horse battery staple" as Very strong (about 153 bits) with no warnings.
Options that matter
- Attack scenario — online throttled (~10 guesses/sec), online unthrottled (~1,000/sec), offline slow hash (~10,000/sec), or offline fast hash (~10 billion/sec).
- Show / Hide — reveal the password being analyzed.
- Example buttons — load a weak, predictable-pattern or strong-passphrase sample.
- Copy report — copy the analysis; the report never contains the password itself.
- Clear — empty the input and reset the analysis.
Things to keep in mind
- The entropy figure is a heuristic based on length, character classes and simple pattern checks, not a guarantee of resistance to attack.
- It checks a fixed built-in list of a few hundred common passwords plus predictable numeric and symbol suffixes; other leaked passwords are not recognised.
- The input accepts at most 256 characters.
- A password whose base is in the common list has its estimate capped at 8 bits (exact match) or 14 bits (base plus suffix), so a longer but predictable string can still be reported as very weak.