# Password Strength Calculator

- **URL:** https://codeasystem.com/calculators/developer/password-strength-calculator/
- **Category:** developer
- **Description:** Estimate password entropy from detected character classes and translate it into average offline crack time at your attack-speed assumption.
- **Primary output:** Estimated entropy: 37.6 bits

## Inputs
- Password to analyze (name: `password`, type: text, example: correct-horse-battery-staple)
- Attacker speed (name: `guessesPerSecond`, type: number, example: 100000000000)

## Outputs
- Estimated entropy: 37.6 bits
- Length: 8 characters
- Detected character-set size: 26 possible characters
- Average crack time @ 100,000,000,000 guesses/sec: 1 seconds
- Verdict: fair

## Formula / methodology
```
entropy = len × log₂(charset)   avg crack time = 2^entropy ÷ 2 ÷ rate
```

Character-class detection assigns each present class its contribution; 26 lowercase, 26 uppercase, 10 digits, 33 symbols, 1 for space; summing to the pool an attacker must search. Entropy equals length times log₂ of that pool.

Average brute-force time divides half the keyspace (the expected position of the answer) by your guesses-per-second rate, then humanizes the seconds. Verdict bands map entropy ranges onto very-weak through very-strong labels.

## Assumptions & limitations
- Assumes the password is uniformly random over its charset; the model OVERESTIMATES strength for human patterns.
- Offline attack at the configured rate; online rate-limited guessing is far slower.
- Dictionary words, repeats and substitutions are not penalized individually.

## How to use
1. **Type the candidate password**; Analysis stays local; never enter real production passwords on sites you distrust.
2. **Set a realistic attack speed**; 1e11/sec models a serious GPU rig against fast hashes; adjust downward for bcrypt/argon2 cost factors.
3. **Read bits, not vibes**; Compare entropy against targets: ~60+ bits for everyday accounts, 80+ for high-value credentials.

## Example
abcdefgh uses only lowercase: 8 × log₂(26) ≈ 37.6 bits; searched exhaustively in seconds at modern GPU rates despite “looking random”.

Result for these inputs:

```
Estimated entropy: 37.6 bits
```

## About this calculator
### The honest limitation of entropy models

This calculator measures search space assuming randomness. Human passwords cluster: dictionary words, keyboard walks, leet substitutions, reused bases with suffixes; real crackers exploit all of it, making actual strength dramatically lower than the bit count implies. Treat results as an optimistic ceiling, and note this warning applies to every naive strength meter.

### Improving a weak score properly

- Add length first; every extra character multiplies work by the pool size
- Prefer passphrases: four random words beat eight clever characters
- Unique per site beats globally strong; breaches leak one site at a time
- Let a password manager generate and remember; memorize only the master passphrase

## FAQs
### Is my password uploaded anywhere?

No. All computation happens in your browser; nothing typed here leaves the page or gets logged.

### Why does “Password123!” score decently despite being terrible?

The model counts only charset and length. Real attackers try human patterns first, so effective strength is much lower than nominal bits suggest; the on-page warning explains this bias.

### What attack speed should I assume?

Around 1e11 guesses/sec for unsalted or fast hashes on commodity GPU rigs; divide substantially for bcrypt, argon2 or per-user salts. The input lets you compare scenarios.

### Why halve the keyspace for crack time?

On average the correct guess appears halfway through an exhaustive search, so expected time is 2^(entropy−1) attempts rather than the full keyspace.

## Related calculators
- [Secure Password Generator](https://codeasystem.com/calculators/developer/password-generator/)
- [SHA Hash Generator](https://codeasystem.com/calculators/developer/hash-generator/)
- [HMAC Generator](https://codeasystem.com/calculators/developer/hmac-generator/)

---
Last updated: 2026-08-23 · Version: 1.0.0 · [HTML version](https://codeasystem.com/calculators/developer/password-strength-calculator/)