Password Strength Meter
Evaluate password security with entropy analysis, crack time estimation, and actionable improvement tips.
Strength Analysis
Entropy
--
bits
Estimated Crack Time
--
at 1B guesses/sec
Improvement Tips
- Enter a password to see feedback
Check how resistant a password is to brute-force attacks before trusting it with an account. This tool measures entropy, estimates real crack time, and gives concrete suggestions — all locally in your browser, so the password you test never leaves your device.
How to Use
- Type a password: Enter the password you want to evaluate.
- Read the score: Get an instant 0–100 score with a level from Very Weak to Very Strong.
- Check crack time: See how long brute force would take at 1 billion guesses per second.
- Follow the feedback: Apply the specific suggestions shown, like adding symbols or length.
Features
- Entropy-based 0–100 score with five strength levels
- Realistic crack-time estimates, from “instantly” to “centuries”
- Specific, actionable feedback instead of a bare score
- Detects missing character classes (lowercase, uppercase, digits, symbols)
- 100% client-side — nothing is transmitted or logged
How Password Strength Is Measured
Strength is fundamentally a question of entropy: how many guesses an attacker needs, on average, to find your password. Entropy is measured in bits, and each extra bit doubles the search space. That space depends on two things — password length and character pool size. Lowercase only gives a pool of 26; adding uppercase, digits, and symbols grows it to 95. Mathematically, entropy is length times the base-2 logarithm of pool size, which is why length beats complexity: going from 8 to 12 lowercase characters adds about 19 bits, while sprinkling symbols into 8 characters adds far fewer. This tool computes that entropy, maps it to five levels (28 bits or below is Very Weak, above 127 is Very Strong), and derives crack time by assuming one billion guesses per second.
Use Cases
- New accounts: Verify a password before committing it to an important service.
- Security audits: Check passwords you still reuse across old accounts.
- Passphrase design: Compare a long passphrase against a short complex password.
- Education: Show others why “P@ssw0rd!” is weaker than it looks.
Tips for Creating Strong Passwords
Length beats cleverness: a 16-character passphrase of random words is both stronger and easier to remember than “Tr0ub4dor&3”-style substitutions, because predictable patterns — capital first letter, trailing number, leetspeak — are what cracking tools try first. Never reuse passwords across sites: one breached database turns a reused password into a master key, and no crack-time estimate protects against that. The setup most professionals recommend is a password manager generating a unique random password per site, guarded by one long master passphrase — the one password you must memorize, and the one to design here.
Related Tools
Frequently Asked Questions
Is my password sent to any server?
No. All password analysis is performed entirely in your browser using JavaScript. Your password never leaves your device and is never stored or transmitted anywhere.
How is password strength calculated?
Strength is calculated using Shannon entropy, which considers both the password length and the variety of character types used (lowercase, uppercase, digits, symbols). Higher entropy means a stronger password. The score is mapped to a 0-100 scale.
What is a good password strength score?
A score of 60 or above is considered "Strong". Aim for at least 12 characters with a mix of uppercase, lowercase, numbers, and symbols. A "Very Strong" password (score 100) uses a long, random combination of all character types.
How accurate is the crack time estimate?
The crack time assumes an attacker can make 1 billion guesses per second (roughly the speed of a modern GPU cluster). It's a reasonable estimate for brute-force attacks but does not account for dictionary attacks or leaked passwords.