Password strength analyser

A password's strength depends on how many guesses an attacker needs, not on whether it contains a symbol. P@ssw0rd! follows complexity rules but is cracked almost instantly because it is a common pattern. This analyser estimates strength by looking at length, character variety and predictable patterns, and shows an estimated time to crack. Everything happens in your browser; the password is never sent anywhere.

How to use it

1. Type a password, preferably one similar to, not identical to, a real one.
2. Read the strength score, entropy and estimated crack time.
3. Follow the warnings to make it stronger.

How strength is estimated

A truly random password's entropy is length × log2(character set size). Twelve random characters from 94 printable symbols give about 79 bits. Human-chosen passwords are far weaker than this formula suggests, so good analysers also detect:

• Dictionary words and names, including leetspeak substitutions like 0 for o.
• Keyboard patterns like qwerty and 1qaz2wsx.
• Dates and years, such as 1995 or 2026.
• Repeats and sequences, such as aaa and abcd.

Crack time depends on the attack

An online attack against a rate-limited login may manage only a few guesses per second. An offline attack against a stolen database of fast hashes like MD5 can try billions per second on a GPU. Slow hashes such as bcrypt or Argon2 reduce that dramatically, which is why sites must use them.

What actually makes passwords strong

• Length beats complexity. A random 5 or 6 word passphrase is both strong and memorable.
• Never reuse passwords; credential stuffing uses leaks from other sites.
• Use a password manager and enable two-factor authentication.