Password Strength Checker

Features

• Entropy calculated in bits from the actual character pool
• Crack-time estimates across four attacker capabilities
• Detects dictionary words, keyboard runs and repetition
• Penalises predictable substitutions like @ for a
• Runs entirely in your browser

How to use it

1. Type or paste a password into the field.
2. Read the entropy figure and the verdict.
3. Check the weaknesses list for specific problems.
4. Use the suggest button if you need a stronger one.

What entropy measures, and what it misses

Entropy in bits describes the size of the search space: each additional bit doubles the number of guesses needed. A password drawn randomly from a 95-character keyboard set carries about 6.6 bits per character, so a 12-character random password is roughly 79 bits. Below 50 bits is weak against a determined offline attack, around 70 is reasonable, and above 100 bits is beyond any foreseeable brute-force capability.

The critical caveat is that this arithmetic only holds for randomly generated passwords. Entropy calculated from the character pool badly overstates the strength of anything a human chose. Password123! scores about 79 bits by that formula but appears in every cracking dictionary and falls in milliseconds. Real attackers do not brute-force blindly, they start with leaked password lists, dictionary words with common substitutions, and keyboard patterns. That is why the weaknesses panel matters more than the headline number.

The crack-time figures assume the attacker has stolen a database and is attacking the hashes offline, which is the realistic threat. The rates vary enormously by hashing algorithm: a consumer GPU manages billions of SHA-256 guesses per second but only tens of thousands against properly configured bcrypt or Argon2. That difference is entirely the defender's choice, which is why how a site stores your password matters as much as how you chose it. In practice, length beats complexity, uniqueness beats both, and a password manager beats trying to remember any of it.