Web Security

Password Strength Estimator

Estimates password entropy and a rough offline crack time locally - the password is never sent or stored.

Loading the tool…

Processing happens locally in your browser. What you paste or load is processed by this page and is not uploaded to a server. Nothing is stored unless you use a control that says it stores something, and you can clear anything this site has kept from the privacy page.

How to use this tool

  1. Type or paste a password. It stays in your browser - nothing is sent or stored.
  2. Select Estimate strength.
  3. Treat the entropy as a generous ceiling and read the pattern warnings, which lower the real strength.
  4. For anything that matters, a long passphrase from a password manager beats a clever short one.

What password strength estimator does

Password strength is usually described with a coloured bar and no arithmetic behind it. The honest measure is entropy: the length multiplied by the log of the character pool, which is the number of guesses an attacker who knows nothing else would need. It is a ceiling, not a floor - a real cracker guesses words, dates and keyboard runs first - but it is a number you can reason about.

Type or paste a password and this reports the character pool it draws from, the estimated entropy in bits, a rough offline crack time, and any pattern - all digits, repeats, a dictionary word - that makes the real strength lower than the number suggests. The password is analysed by arithmetic on this page: it is never sent anywhere, never stored, and never compared against any breach list. There is no network call to make.

Frequently asked questions

No. The estimate is arithmetic performed on this page. The password is never transmitted, never stored, and never compared against any breach or dictionary list. There is no network call for it to travel on.

The formula assumes the characters were chosen at random from the pool. A human-chosen password built from words, dates or keyboard runs is guessed far sooner than that, because a cracker tries those first. The tool warns when it spots such a pattern.

As a rough guide, under about 60 bits is weak for anything that matters and the tool flags it. Higher is better, but length from a passphrase or a password manager is a more reliable way to get there than adding symbols to a short password.