Entropy · crack-time estimates · character class analysis · common password detection
Password Strength Checker analyzes any password and rates its strength based on length, character diversity, common patterns, and known breach databases. It calculates the estimated crack time using brute-force and dictionary attacks, shows exactly which criteria your password fails, and suggests specific improvements — all processed locally in your browser without sending your password anywhere.
Password strength depends on entropy: the number of possible values for each character position times the number of positions. A 12-character password using lowercase only has 26^12 ≈ 95 trillion combinations — a modern GPU can test 10 billion per second, cracking it in about 2.6 hours. Adding uppercase (52 characters) makes it 52^12 ≈ 390 quadrillion — over 11 years. Adding numbers and symbols (95 characters) gives 95^12 ≈ 540 septillion — over 17 million years.
The most dangerous passwords are common words, keyboard patterns (qwerty, 123456), and simple substitutions (p@ssw0rd). Attackers use dictionary attacks with millions of real passwords from data breaches — the 100,000 most common passwords are checked in seconds. Length matters more than complexity: a random 20-character lowercase string is far stronger than a short complex one.
'password' (8 chars, all lowercase)
Result: Strength: Very Weak / Crack time: Instant (dictionary attack hits this immediately)
'P@ssw0rd!' (9 chars, mixed)
Result: Strength: Weak / Crack time: Minutes (common substitution pattern, in breach databases)
'kT9$mX2#vQ7p' (12 chars, random)
Result: Strength: Strong / Crack time: Centuries (high entropy, not in dictionaries)
What makes a password strong?
Length is most important — each additional character multiplies the search space. Use at least 12-16 characters. Random is better than patterned — 'horse battery staple' is weaker than random characters of similar length because dictionary attacks test word combinations. Include uppercase, lowercase, numbers, and symbols.
Why does 'P@ssw0rd' score low despite having symbols?
Common substitutions (a→@, o→0, e→3, i→!) are known to attackers and are included in attack dictionaries. A password based on a dictionary word with substitutions is still a dictionary-based password. A random character string of the same length is vastly stronger.
Should I use a passphrase instead?
A truly random passphrase of 4-5 common words (e.g., from a dice word list like Diceware) can be strong and memorable. 'correct-horse-battery-staple' has about 44 bits of entropy from a 7,776-word list — comparable to a random 8-character password. Use a password manager instead of memorizing passphrases.
Why can't my browser save passwords?
Browser-saved passwords are convenient but have risks: they can be extracted if your computer is compromised, are tied to a browser rather than a device, and may sync to cloud storage. A dedicated password manager (1Password, Bitwarden, KeePass) provides better encryption, cross-device sync, and breach monitoring.
Is this tool checking my password against a breach database?
Locally: yes — it checks against the most common 100,000 passwords from breach data included in the tool. Full Have I Been Pwned checks require sending a hash to an external API (which this tool does not do by default to avoid any data transmission). For a full check, visit haveibeenpwned.com directly.