Password Strength Meter

Password strength is a statement about how many guesses an attacker needs to find a password by brute force. This tool converts that into a plain 0-100 score, a strength label, an estimated crack time, and targeted advice for the exact password you type. The evaluation happens in your browser as you type; the password is never submitted anywhere.

How to Use

1. Type or paste a password into the input field.
2. Read the score, the level from Very Weak to Very Strong, and the crack-time estimate, which update on every keystroke.
3. Check the feedback line, which flags missing length or missing character classes rather than giving a vague verdict.
4. Change the password and repeat until it matches the security of the account you are protecting.

There is no generate or submit button. Clearing the field resets everything to zero and shows an empty-password message.

The Entropy Formula Behind the Score

The tool counts which of four classes the password uses, adds up their pool sizes, and computes:

entropy = length × log2(pool size)

Entropy is measured in bits, and each extra bit doubles the guess space. The score then maps those bits onto 0-100 with round(entropy / 128 × 100), capped at 100. The level uses the raw bits:

Level	Entropy in bits
Very Weak	28 or below
Weak	29 to 35
Fair	36 to 59
Strong	60 to 127
Very Strong	above 127

Because the level is based on raw bits while the score is a rescaled percentage, a password can read Strong and still score in the forties. The crack time is 2^entropy / 1,000,000,000 seconds, assuming an offline attack against a fast hash.

Worked Examples

Password	Length	Pool	Entropy	Score	Level	Crack time
password	8	26	37.60	29	Fair	3 minutes
P@ssw0rd!	9	95	59.13	46	Strong	19 years
Tr0ub4dor&3	11	95	72.27	56	Strong	1,803 centuries
correcthorsebatt	16	26	75.21	59	Strong	13,828 centuries
X7#kQ9$mZ2&vL4nR	16	95	105.12	82	Strong	13,956,325,109,454 centuries
A1b2C3d4E5f6G7h8I9j0K1	20	95	130.99	100	Very Strong	858,638,904,047,015,600,000 centuries

The last row shows what it takes to actually reach Very Strong: about 131 bits, which for a random mixed password means roughly 20 characters. Sixteen truly random characters land at 105 bits and still read as only Strong.

Why Length Beats Complexity

The two mid-table examples make the point. correcthorsebatt is 16 lowercase letters with no symbols or digits, and it beats the 11-character mixed-case Tr0ub4dor&3 by about 3 bits. Each extra lowercase character adds log2(26) ≈ 4.7 bits; each extra mixed character adds log2(95) ≈ 6.57 bits. Pool expansion is worth more per character, but adding characters is something most people can keep doing, and a longer passphrase is also easier to remember than a short string of substitutions.

Turning the Feedback Into a Better Password

When the feedback says a password is too short, the fastest fix is to add characters, not symbols. Compare Sunset7!, eight characters at about 52 bits, with sunsetrivercabin, sixteen lowercase characters at about 75 bits. The longer phrase is easier to remember and roughly ten million times harder to brute-force. If you want the meter to reward something memorable, pick four or five unrelated words and join them with a character only you know. If you want maximum strength instead, let a manager generate 16 to 20 random characters across all four classes; a 20-character random string crosses the 127-bit line into Very Strong. Either route leads to the same habit that matters most: a unique password per account, so that one breached database cannot be replayed against another service.

What the Crack-Time Number Really Means

The estimate assumes the attacker already has a fast hash of your password and can test a billion candidates per second. That is a reasonable model for an unsalted MD5 or SHA-1 dump and a high-end GPU setup. It is pessimistic for a well-run login page that rate-limits attempts, and wildly optimistic for bcrypt, scrypt, or Argon2 hashes, which slow each guess by orders of magnitude. Treat the number as a comparative signal, not a promise.

The rate also swings with hardware. A single high-end GPU can fall short of a billion guesses per second against a deliberately slow hash, while a purpose-built cracking rig with many GPUs can push well past it against something like unsalted MD5. Online services add another layer: rate limiting, account lockouts, and CAPTCHAs make repeated guesses impractical, which is why the same password can be safe for a bank login and fragile in an offline dump. The meter reports one consistent attacker model so the numbers stay comparable across passwords.

What This Tool Cannot Catch

Entropy measures the size of the search space, not whether an attacker would actually search it. Several common weaknesses are invisible to the formula:

• Dictionary words and names, including well-known substitutions like @ for a and 0 for o.
• Keyboard walks such as qwerty, asdfgh, or 1qaz2wsx.
• Passwords reused from a breached site; credential stuffing needs no cracking at all.
• Dates, phone numbers, and other personal details an attacker can look up.
• Repeated or patterned content, for example abcabcabcabc, which the math treats as high entropy.

The practical conclusion is to combine this meter with a password manager that generates a unique random password per site, and to enable two-factor authentication where it is offered.

Related Tools

• Password Generator
• Hash Generator
• AES Encryption