Developer & Tech

Password Strength Calculator

What this does

Estimate password entropy from detected character classes and translate it into average offline crack time at your attack-speed assumption.

Enter your details

Runs in your browser

Calculator inputs

How to use it

Using the password strength calculator

  1. 01

    Type the candidate password

    Analysis stays local; never enter real production passwords on sites you distrust.

  2. 02

    Set a realistic attack speed

    1e11/sec models a serious GPU rig against fast hashes; adjust downward for bcrypt/argon2 cost factors.

  3. 03

    Read bits, not vibes

    Compare entropy against targets: ~60+ bits for everyday accounts, 80+ for high-value credentials.

Good to know

The honest limitation of entropy models

This calculator measures search space assuming randomness. Human passwords cluster: dictionary words, keyboard walks, leet substitutions, reused bases with suffixes; real crackers exploit all of it, making actual strength dramatically lower than the bit count implies. Treat results as an optimistic ceiling, and note this warning applies to every naive strength meter.

Improving a weak score properly

  • Add length first; every extra character multiplies work by the pool size
  • Prefer passphrases: four random words beat eight clever characters
  • Unique per site beats globally strong; breaches leak one site at a time
  • Let a password manager generate and remember; memorize only the master passphrase

How it's calculated

The math behind this calculator

entropy = len × log₂(charset) avg crack time = 2^entropy ÷ 2 ÷ rate

Character-class detection assigns each present class its contribution; 26 lowercase, 26 uppercase, 10 digits, 33 symbols, 1 for space; summing to the pool an attacker must search. Entropy equals length times log₂ of that pool.

Average brute-force time divides half the keyspace (the expected position of the answer) by your guesses-per-second rate, then humanizes the seconds. Verdict bands map entropy ranges onto very-weak through very-strong labels.

Assumptions & limitations

  • Assumes the password is uniformly random over its charset; the model OVERESTIMATES strength for human patterns.
  • Offline attack at the configured rate; online rate-limited guessing is far slower.
  • Dictionary words, repeats and substitutions are not penalized individually.

Worked example

abcdefgh uses only lowercase: 8 × log₂(26) ≈ 37.6 bits; searched exhaustively in seconds at modern GPU rates despite “looking random”.

FAQ

Frequently asked questions

Is my password uploaded anywhere?
No. All computation happens in your browser; nothing typed here leaves the page or gets logged.
Why does “Password123!” score decently despite being terrible?
The model counts only charset and length. Real attackers try human patterns first, so effective strength is much lower than nominal bits suggest; the on-page warning explains this bias.
What attack speed should I assume?
Around 1e11 guesses/sec for unsalted or fast hashes on commodity GPU rigs; divide substantially for bcrypt, argon2 or per-user salts. The input lets you compare scenarios.
Why halve the keyspace for crack time?
On average the correct guess appears halfway through an exhaustive search, so expected time is 2^(entropy−1) attempts rather than the full keyspace.

Keep exploring

Related calculators