Password Strength Checker

Password meters are everywhere, but most are little more than a colored bar with no honest math behind it. The Password Strength Checker takes the transparent route: as you type, it measures how many character classes your password actually uses, multiplies that pool size by length to compute real entropy in bits, and converts the result into an average crack time under four escalating attack models, an online attack at 10^10 guesses per second, an offline single CPU at 10^12, a GPU cluster at 10^14, and a state-actor rig at 10^16. Alongside the bit count, a composition panel tallies uppercase, lowercase, digit, and symbol counts, and an analysis-notes card flags genuine weaknesses: membership in a common-password list, a common password hidden inside a longer string, repeated runs like aaa, sequential runs like abc or 321, keyboard walks such as qwerty or asdf, and single-class passwords. Everything runs in your browser; the password you paste is never transmitted or stored. That makes this password entropy calculator equally useful as a quick how-long-would-it-take-to-crack check before you commit a new credential to your manager or roll out a policy to your team.

1. 1

   Type or paste a credential into the Password field; analysis starts immediately and there is no submit button.

2. 2

   Click the eye toggle inside the field to switch between hidden and visible text.

3. 3

   Read the Strength line for a label plus entropy in bits, and the bar beneath it to see where the value falls between 0 and 256 bits.

4. 4

   Scroll to the Estimated crack time card to see average breaking time under online, offline-fast, GPU-cluster, and massive attack models.

5. 5

   Check the Composition card for length and character-class counts, then review Analysis notes for patterns like keyboard walks or sequential runs.

• Reality-checking a candidate password before saving it in a password manager.
• Demonstrating to teammates why length beats symbol tricks when drafting a company password policy.
• Spotting leaked-pattern risks such as common substrings embedded inside longer passwords.
• Comparing candidate credentials for admin or root accounts where offline attacks are realistic.
• Teaching users to recognize keyboard patterns like qwerty and repeated runs like aaa.
• Auditing credentials generated by other tools to confirm they clear the 128-bit bar.

• Ignore advice that Tr0ub4dor&-style tricks are strong; the 260-day GPU figure shows symbol substitution adds little against offline rigs.
• Treat anything below 60 bits as unacceptable for an account that stores value.
• When Analysis notes flag a common substring, change the whole password rather than appending digits to it.
• Aim for 16+ characters across at least three classes to earn the tool's "Excellent length and character variety" note.
• Test only candidate passwords, never a production credential you actively use, even though nothing is transmitted.
• Prefer a generated passphrase from the Secure Passphrase Generator when raw strength plus memorability both matter.

• Type slowly and watch the Analysis notes update live; pattern detection runs on every keystroke.
• Use the eye toggle to verify what you typed; hidden input is the leading cause of false "password incorrect" reports.
• Test a few variants of a favorite scheme to see how little symbol swapping actually buys you.
• Treat the Massive row as your long-term budget when the account protects money, mail, or code repositories.