What entropy score counts as good?

The tool maps fixed bands: under 28 bits is Very Weak, under 36 Weak, under 60 Fair, under 128 Strong, and above that Very Strong. For web accounts defended by throttled online attacks, 60+ bits is workable. For anything stored where an attacker can grab a hash and crack offline, aim for 128 bits or more.

Why does the estimated crack time assume four rates?

Because a password is only as strong as the worst attacker it will face. An online attack is capped near 10^10 guesses per second by throttling, a single CPU with hashcat runs near 10^12, a GPU cluster approaches 10^14, and a funded state actor can exceed 10^16. Showing all four prevents the false comfort of one optimistic number.

What counts as a keyboard pattern?

The checker scans for three-character slices of the rows qwertyuiop, asdfghjkl, and zxcvbnm in either direction, so asdf, fdsa, and qwe all trigger a warning. Attackers run the same dictionaries, which makes these sequences nearly as weak as common words, especially when the rest of the password is short.

Why does a strong password still get warnings?

Entropy measures raw guessing difficulty, but humans introduce predictable structure that brute-force math cannot see. A password like LetMeIn2024! scores Strong on bits yet embeds letmein, one of the most common passwords ever, so the substring warning fires. Treat every Analysis note as a reason to regenerate rather than a false positive.

How are crack times calculated?

The tool computes guesses as 2 raised to the entropy power, divides by two to model the average case where the attacker hits the correct value halfway through the search space, then divides by each attack model's rate. Results round into human units: seconds, minutes, hours, days, months, years, centuries, millennia, or "longer than the universe".

Security

Password Strength Checker

Estimate password entropy and crack time honestly.

passwordstrengthentropycrackcheck

Loading tool…

Recommended tools

ProtonVPN

Privacy-first VPN with no-logs policy.

Affiliate links — we may earn a commission if you sign up.

About the Password Strength Checker

Password meters are everywhere, but most are little more than a colored bar with no honest math behind it. The Password Strength Checker takes the transparent route: as you type, it measures how many character classes your password actually uses, multiplies that pool size by length to compute real entropy in bits, and converts the result into an average crack time under four escalating attack models, an online attack at 10^10 guesses per second, an offline single CPU at 10^12, a GPU cluster at 10^14, and a state-actor rig at 10^16. Alongside the bit count, a composition panel tallies uppercase, lowercase, digit, and symbol counts, and an analysis-notes card flags genuine weaknesses: membership in a common-password list, a common password hidden inside a longer string, repeated runs like aaa, sequential runs like abc or 321, keyboard walks such as qwerty or asdf, and single-class passwords. Everything runs in your browser; the password you paste is never transmitted or stored. That makes this password entropy calculator equally useful as a quick how-long-would-it-take-to-crack check before you commit a new credential to your manager or roll out a policy to your team.

Hand-written guide

Examples

Input

dragon

Output

Strength: Weak · 28.2 bits
Composition: Length 6 · Lowercase 6 · Pool 26
Analysis notes:
- This is a commonly-used password — it will be cracked instantly.
- Shorter than 8 characters — too short for any account.
- Uses only one character class — mix letters, digits, and symbols.
Estimated crack time (all four models): instant

Note: dragon sits in the built-in common-password list, so the danger note fires before the entropy math even matters.

Input

Tr0ub4dor&3

Output

Strength: Strong · 71.9 bits
Composition: Length 11 · Uppercase 1 · Lowercase 6 · Digits 3 · Symbols 1 · Pool 93
Estimated crack time:
- Online attack (10^10/s): 71 centuries
- Offline fast (10^12/s): 71 years
- GPU cluster (10^14/s): 260 days
- Massive (10^16/s): 62 hours

Note: The classic xkcd example: decent on paper, but a GPU cluster grinds through it in under a year.

Input

LetMeIn2024!

Output

Strength: Strong · 78.5 bits
Composition: Length 12 · Uppercase 3 · Lowercase 4 · Digits 4 · Symbols 1 · Pool 93
Analysis notes:
- Contains a common password inside it — easy to guess.
Estimated crack time:
- Online attack: 663 millennia
- Offline fast: 66 centuries
- GPU cluster: 66 years
- Massive: 242 days

Note: letmein hides inside the string, so the tool flags the common-password substring even though raw entropy says Strong.

How to use

1
Type or paste a credential into the Password field; analysis starts immediately and there is no submit button.
2
Click the eye toggle inside the field to switch between hidden and visible text.
3
Read the Strength line for a label plus entropy in bits, and the bar beneath it to see where the value falls between 0 and 256 bits.
4
Scroll to the Estimated crack time card to see average breaking time under online, offline-fast, GPU-cluster, and massive attack models.
5
Check the Composition card for length and character-class counts, then review Analysis notes for patterns like keyboard walks or sequential runs.

Common use cases

Reality-checking a candidate password before saving it in a password manager.
Demonstrating to teammates why length beats symbol tricks when drafting a company password policy.
Spotting leaked-pattern risks such as common substrings embedded inside longer passwords.
Comparing candidate credentials for admin or root accounts where offline attacks are realistic.
Teaching users to recognize keyboard patterns like qwerty and repeated runs like aaa.
Auditing credentials generated by other tools to confirm they clear the 128-bit bar.

Best practices

Ignore advice that Tr0ub4dor&-style tricks are strong; the 260-day GPU figure shows symbol substitution adds little against offline rigs.
Treat anything below 60 bits as unacceptable for an account that stores value.
When Analysis notes flag a common substring, change the whole password rather than appending digits to it.
Aim for 16+ characters across at least three classes to earn the tool's "Excellent length and character variety" note.
Test only candidate passwords, never a production credential you actively use, even though nothing is transmitted.
Prefer a generated passphrase from the Secure Passphrase Generator when raw strength plus memorability both matter.

Tips

Type slowly and watch the Analysis notes update live; pattern detection runs on every keystroke.
Use the eye toggle to verify what you typed; hidden input is the leading cause of false "password incorrect" reports.
Test a few variants of a favorite scheme to see how little symbol swapping actually buys you.
Treat the Massive row as your long-term budget when the account protects money, mail, or code repositories.

Frequently asked questions

No. The entire analysis, character counting, entropy, and crack-time estimation, runs inside your browser via React state. The password never leaves the page, there is no network call, and nothing is stored or logged. The privacy note under the card title is not marketing; it describes the actual architecture of the tool.

Explore more security tools

Browse the full collection of security tools on the hub, or jump back to all categories.

All Security tools All categories