Password Strength Checker
Estimate real password entropy, detect patterns that make it weaker than it looks, and see honest crack-time estimates for different attack scenarios.
Result
Crack time estimates
| Attack scenario | Guess rate | Expected time to crack |
|---|---|---|
| Online, rate limited (100/s) | 1e+2/s | 1.99e+12 years |
| Online, unthrottled (10k/s) | 1e+4/s | 1.99e+10 years |
| Offline, bcrypt (100k/s) | 1e+5/s | 1.99e+9 years |
| Offline, fast hash on GPUs (10^11/s) | 1e+11/s | 1989.3 years |
| Nation-state offline (10^14/s) | 1e+14/s | 2 years |
Weaknesses detected
- Contains a four-digit year - a standard mutation rule in cracking tools.
About Password Strength Checker
Password strength is measured in entropy - how many guesses an attacker expects to need. Character-class rules are a poor proxy for it, because humans satisfy them in predictable ways that cracking tools model explicitly.
Why breach corpora beat brute force
Real attacks rarely start with brute force. They start with the billions of passwords already exposed in breaches, then apply mutation rules — capitalise, append a year, substitute a for @ — to each one. A password with 60 bits of theoretical entropy is worthless if it appears in a wordlist, and no strength meter can see that. Checking a password against a breach corpus (using a k-anonymity API so the password itself is never sent) tells you more than any entropy calculation, and should be part of any password policy that intends to work.
Why pattern penalties matter
Summer2026! scores well on naive entropy: eleven characters, four character classes, about 72 bits. In reality it matches a rule every cracking wordlist applies - capitalised dictionary word, year, symbol - and falls in seconds. Real strength comes from unpredictability, which is why generated passwords and long passphrases outperform anything a person composes.
Common use cases
- Explaining to a team why the corporate password policy is not producing strong passwords.
- Sanity-checking a passphrase scheme before adopting it.
- Comparing the value of extra length against extra character classes.
Edge cases and gotchas
- Estimates assume brute force; a password already in a breach corpus is cracked instantly regardless of entropy.
- Never enter a live credential into any web tool, this one included.