Overview
People judge passwords by appearance — a tangle of symbols feels strong, a plain word feels weak. Attackers do not judge by appearance at all; they count. This checker counts the way they do, converting your password into two honest numbers: its entropy in bits, and a realistic estimate of how long it survives a sustained guessing attack. If the answer surprises you, the surprise is the lesson.
Because passwords are the most sensitive strings most people own, the page was built so the check cannot leak. Every calculation runs on your device in real time as you type — keystroke analysis, pattern detection and all — and nothing is transmitted anywhere. Test freely, including the real passwords you already use; the only honest test is the real one.
How is “crack time” estimated?
From entropy and an assumed guessing speed. A password with E bits of entropy has roughly 2^E possibilities; divide by guesses per second and you get seconds to exhaust the space (on average, half that). The checker assumes a well-resourced attacker — billions of guesses per second with modern hardware — so the estimate is deliberately pessimistic. A password that survives that math will survive reality.
The estimate also discounts for patterns. “P@ssw0rd2024!” looks complex but follows rules attackers encode on day one: common word, leetspeak substitutions, a year, a trailing symbol. The checker flags dictionary words, sequences, repeats and keyboard walks, because a clever-looking password built from known tricks falls far faster than its raw length suggests.
Features
- Live entropy readout in bits, updating with every keystroke.
- Crack-time estimate against a realistic, well-equipped attacker.
- Pattern warnings for dictionary words, sequences, repeats and keyboard walks.
- Strength grading from weak to very strong with plain-language guidance.
- Character-set breakdown showing which families your password actually uses.
- 100% local analysis — safe to test your real, current passwords.
- No storage: results vanish when you leave or clear the field.
Benefits
- Learn what actually matters. Length beats decoration, every time.
- Audit your existing passwords without exposing them to anyone.
- Spot false confidence — the clever-looking password that is secretly weak.
- Make better secrets with feedback grounded in attacker math, not vibes.
Who can use it
Everyone with a password they are unsure about — which covers the creative substitutions and “strong-looking” secrets most of us invented years ago. IT teams can use it in security training to demonstrate why composition rules mislead. And after any breach notice involving a service you use, it is the fastest way to judge whether your password there was ever adequate.
How to use
- Type or paste a password into the test field.
- Read the entropy score and the crack-time estimate.
- Review any pattern warnings — dictionary words, sequences, repeats.
- Adjust the password and watch the numbers respond in real time.
- When it grades strong, save it in a password manager and move on.
Frequently asked questions
Is it safe to type my real password here?
Yes — that is the point of the design. The analysis is pure JavaScript running in your browser; no keystroke, character or result is sent to any server. The honest test is your real password, and this page is built so you can run it without trusting anyone.
My password got a bad grade but has symbols — why?
Because attackers model human tricks. A dictionary word with predictable substitutions (a→@, o→0), a year, and a trailing exclamation mark is one of the first patterns guessing software tries. Symbols add real strength only when the underlying string is already unpredictable — decoration on a guessable base fools people, not attackers.
What crack-time should I aim for?
Centuries against the assumed attacker is comfortable for important accounts; anything under a few years deserves replacement. Remember the estimate assumes offline guessing at billions of attempts per second — online logins with rate limiting are far slower to attack, but offline breaches of password databases are exactly the scenario that matters.
Does length really beat complexity?
Overwhelmingly. Each extra character multiplies the search space by the pool size, while complexity tricks add only a small constant factor attackers already model. A 20-character passphrase of plain words dwarfs a 10-character symbol salad. When in doubt, make it longer, not weirder.
Why does the grade change as I type?
Because every character changes both the entropy and the pattern analysis. Adding a character always adds entropy; but completing a dictionary word or a sequence can trigger a pattern warning that discounts the score. The live feedback is the teaching mechanism — experiment and watch.
Should I test passwords I use at work?
On this page, yes — nothing leaves your device, so there is no policy conflict in the testing itself. What you should not do is paste work passwords into random online checkers that transmit them. The local-only design is precisely what makes this one safe for that.
Conclusion
Strength is a number, not a feeling. Test the passwords you already have, learn what the meter rewards, and replace anything that cannot survive the math.