Password Strength Checker

The Password Strength Checker measures how resistant a password is to guessing and cracking. As you type, it estimates the password's entropy in bits, assigns a strength label from very weak to very strong, and models how long the password would survive a real attack. Every calculation happens on your device, so the value you enter is never transmitted, stored, or logged.

Entropy is the core metric: it is roughly the length of the password multiplied by the log base 2 of the character pool it draws from. Adding lowercase letters, uppercase letters, digits, and symbols widens that pool, but length has the larger effect because it multiplies entropy for every single character. That is why a long passphrase almost always outscores a short string padded with special characters.

Raw math alone overstates security, so the checker also looks for predictable patterns and discounts them. It flags passwords found in leaked-credential lists, embedded dictionary words, repeated runs such as aaa or 111, keyboard and sequential patterns like 1234, qwerty and azerty, appended years, and the very common Capital-letter-plus-word-plus-digits shape. Attackers try exactly these first, so each one lowers the effective strength.

Two crack-time scenarios put the entropy in context: a fast offline attack at ten billion guesses per second, typical of a GPU rig working from a stolen hash, and a throttled online attack at a thousand guesses per second against a live login. Because the tool is a client-side page served from EU infrastructure with no trackers, you can safely evaluate a real password and act on the guidance without it ever leaving the browser.