Password strength checker and crack-time estimator
Test password strength with real pattern detection — dictionary words, keyboard runs, dates, leetspeak — and crack times. Nothing leaves the page.
- Runs in your browser
- Nothing you enter is sent
- Free, no account
Your password is never sent anywhere. There is no form submission, no API call and no analytics on this page — the analysis below runs in JavaScript inside this tab, against dictionaries embedded in the page itself. Nothing is stored, and closing the tab discards everything.
Safe to paste a real password. If that still makes you uneasy — a healthy instinct — type something with the same shape instead: same length, same mix of words, digits and symbols.
Enter a password to see its entropy, the patterns inside it and how long each kind of attack would take.
How to read the result
- Type or paste the password. It stays masked unless you press the eye button, and it is never sent anywhere — the analysis runs in JavaScript in this tab.
- Compare the two entropy figures. "Naive" is what a typical meter would report. "Adjusted" is what the password is actually worth once known patterns are priced in. A large gap between them means your password looks strong but is not.
- Read the segmentation. The coloured chips show how a cracker would break the string into pieces. Green segments are the parts that still have to be brute-forced; everything else came cheap.
- Check the crack-time table. The row that matters depends on how the site stores your password, which you cannot know — so plan for the fast-hash row.
- Act on the advice. The suggestions are generated from the specific patterns found, not from a generic checklist.
How the estimate is calculated
Most password meters count character classes and multiply by length. That formula assumes
every character was chosen at random, which is exactly the assumption human-chosen passwords
violate. By that formula P@ssw0rd1 scores 59 bits — "strong" on most sites — while
in reality it falls in well under a second, because it is one dictionary word plus three
substitutions every cracking ruleset applies automatically.
This tool does what a cracker does instead:
- Find every match. Breached-password entries in rank order, English dictionary words, names, months and teams — each also checked reversed and with leetspeak undone — plus keyboard runs, ascending and descending sequences, repeated blocks, years and dates.
- Price each match in guesses. A breached password costs its rank in the
list:
123456is one guess. A dictionary word costs the size of the dictionary. Capitalisation variants multiply the cost by two for the common patterns, or by the number of ways to choose the capitalised positions for genuinely scattered case. Leetspeak multiplies by two per substituted character type. - Cover the password as cheaply as possible. Dynamic programming finds the minimum-cost way to explain the whole string left to right, with anything left over priced at full brute-force cost over the alphabet the password uses.
- Add the cost of the arrangement. The attacker also has to try the different ways of splitting a password into pieces, so the factorial of the number of structured segments is folded in.
Where the crack times come from
| Scenario | Rate | What it represents |
|---|---|---|
| Online, rate limited | 100 per hour | A login form that locks the account or adds delays after repeated failures. |
| Online, no throttling | 1,000 per second | Credential stuffing against an API with no lockout, bounded by the network. |
| Offline, slow hash | 20,000 per second | The database has leaked and passwords were stored with bcrypt, scrypt or PBKDF2. |
| Offline, fast hash | 100 billion per second | The database has leaked and passwords were stored as unsalted MD5 or SHA-1. |
Each time is the guess count divided by the rate and halved, because on average an attacker finds a password halfway through the search rather than at the end.
The limits of any strength checker
Be sceptical of the number, including this one. Three honest caveats:
- The dictionary here is small. Around 1,500 entries against a real rig's tens of millions, plus mangling rules generated from actual breach data. Anything this tool calls a dictionary word is definitely weak; something it calls unpredictable may still be in a wordlist it does not carry.
- It cannot know what is personal to you. Your street name, your child's birthday, your first car — all trivially guessable by someone who knows you or has read your social media, and all invisible to a generic analyser.
- Strength is not the main risk. Most accounts are lost to reuse, phishing and malware, none of which care how many bits the password has. A perfect password typed into a convincing fake login page is a compromised password.
Read the score as an upper bound: your password is never stronger than the figure shown, and often weaker.
What a good result looks like
| Adjusted entropy | Rating | Reasonable use |
|---|---|---|
| under 28 bits | Very weak | Nothing. Replace it today. |
| 28 to 35 bits | Weak | A throwaway forum account you would not mind losing. |
| 36 to 59 bits | Fair | Low-value accounts behind a rate-limited login. |
| 60 to 79 bits | Strong | Ordinary accounts, assuming two-factor is also on. |
| 80 bits and above | Excellent | Email, banking, and a password manager's master password. |
Fixing a weak password
The fix is almost never "add another symbol". If the tool found a dictionary word doing most of the work, no amount of decoration around it will help — the word is the problem. Generate a genuinely random password and store it in a password manager, or use a passphrase of five or six randomly chosen words if you need to type it from memory. Then turn on two-factor authentication, which protects you even in the cases a strong password does not.
Questions
Is it safe to type my real password in here?
Technically yes: the page makes no network requests, has no form submission and no analytics, and every dictionary it uses is embedded in the page itself. Nothing is stored and closing the tab discards everything. That said, staying suspicious of any box asking for your password is a good habit — if you would rather not, type a password with the same shape instead: same length, same mix of words, digits and symbols.
Why is my score lower here than on other sites?
Most meters just count character classes and length, which rewards "P@ssw0rd1" for having four classes. This one looks for the structure a cracker looks for — breached passwords, dictionary words, reversals, leetspeak, keyboard runs, sequences, repeats and dates — and prices each piece separately. The result is much closer to what actually happens in an attack.
What is the difference between naive and adjusted entropy?
Naive entropy is log2(alphabet ^ length): what you would get if every character were chosen at random. Adjusted entropy is the cost of the cheapest way to describe your password using known patterns. For a randomly generated password the two are the same; for anything human-invented the adjusted figure is usually far lower, and that is the one that matters.
Where do the crack times come from?
From the adjusted guess count divided by an assumed attack rate, halved because on average an attacker finds a password halfway through the search. The four rates shown span a rate-limited login form, an unprotected API, a slow hash such as bcrypt, and an eight-GPU rig grinding unsalted SHA-1.
How big is the dictionary it checks against?
Around 1,500 entries: the most common breached passwords in rank order, plus everyday English words, first names, months, cities and teams. A real cracking rig loads tens of millions. Treat the score as a best case — your password is never stronger than the number shown, and quite often weaker.