A password is only as strong as the math behind it. This password strength checker scores any password you type from 0 to 100, measures its entropy in bits, and estimates how long an offline attacker would need to crack it by brute force. Because the entire calculation runs in your browser, the password you type never leaves this page — you can safely test the real credentials you actually use without exposing them to a server.
The scoring model combines three ideas: how long the password is, how many character classes it mixes (lowercase, uppercase, digits, symbols), and how badly it violates common patterns that attackers try first. A short but random password beats a long but predictable one almost every time, and the examples below show exactly why.
How to Use
- Type or paste the password you want to test into the Password to Test field. The score, entropy, and crack time update as you type.
- Set Assumed Character Pool Size to match the classes your password uses: 26 for lowercase only, 52 for upper+lower, 62 for letters+digits, or 94 for full printable ASCII (the default).
- Leave Offline Guesses per Second at the default 10,000,000,000 (10 billion). That is a realistic estimate for a single modern GPU rig running a tool like hashcat against a stolen hash dump.
- Raise the guess rate to 1,000,000,000,000 (1 trillion) to stress-test against a well-funded attacker or a botnet. This is the "what if the adversary has a data center?" scenario.
- Read the result card from top to bottom: Strength Score, Rating, Entropy, and Avg. Time to Crack.
- If the rating is weak or fair, lengthen the password first (add a few random words), then mix in uppercase letters, digits, and symbols. Length matters more than complexity.
- For each of your important accounts, generate a unique password with a password manager and run it through this checker once before saving it.
The checker is intentionally conservative. A score below 60 means a determined attacker will probably crack it within hours; 80 or above means the password would take longer than the age of the universe at the default attack rate. Entropy values are shown to two decimal places.
How the Score Is Built
Entropy is the foundation. If a password uses only lowercase letters, the attacker is choosing from a pool of 26 characters per position. Mix in uppercase (26 more), digits (10 more), and symbols (about 32 more), and the pool grows to roughly 94. Entropy in bits is:
entropy = length × log₂(pool_size)
An 8-letter lowercase password like password uses a pool of 26, giving 8 × log₂(26) ≈ 37.6 bits. A 10-character mixed password like Tr0ub4d0r! uses a pool of 94, giving 10 × log₂(94) ≈ 65.5 bits. Each extra bit of entropy doubles the work an attacker must do, so 65 bits is not "a little stronger" — it is about 2³⁰ times stronger, roughly a billion times the effort.
The 0–100 score is derived directly from the entropy: score ≈ entropy × 1.3, capped at 100. This means an 8-letter lowercase password like password produces 37.6 bits and a score of about 49/100 — fair by pure math, but in practice far weaker because dictionary tools like zxcvbn apply heavy penalties for common words. That is why password falls in seconds even though its raw entropy looks mediocre: any attacker tries the top 10,000 dictionary words first.
Examples
Example 1 — The textbook weak password. Type password and set the character pool to 26 (lowercase only), leaving the attack rate at 10 billion guesses/sec. The length is 8, the pool is 26, entropy is 37.6 bits, and the score is 49/100 — fair by the pure entropy model. The average time to crack is about 10.44 seconds. In the real world, though, an attacker does not need to brute force it at all: password is the first or second word in every dictionary attack, so it falls instantly.
Example 2 — A strong leetspeak password. Type Tr0ub4d0r!. The length is 10, the pool is 94, entropy is 65.5 bits, and the score is 85/100 — very strong. At 10 billion guesses/sec the average crack time is roughly 2.7 × 10⁹ seconds, or about 85 years. Raise the attack rate to 1 trillion and that number shrinks to under a year, which is exactly why long random passphrases beat clever leetspeak substitutions.
Example 3 — A long passphrase wins. Type correct-horse-battery-staple (add hyphens). The score jumps into the 80s and the crack time stretches to millions of years, even though it uses only lowercase letters and hyphens. Length is doing all the work here, and that is the practical lesson: spending $3 or $5 a month on a password manager to store 30-character random strings is cheaper than the hours you would spend recovering from an account takeover.
Example 4 — The 1-million-plus stress test. Set Offline Guesses per Second to 1,000,000,000,000 (one trillion, which is well above the 1,000,000 threshold that marks a serious attacker). A score of 85/100 at that rate still survives for thousands of years, but a 40/100 password falls in seconds. Use this view to see which of your passwords are actually safe against a funded adversary.
FAQ
What does the 0–100 score mean?
The score is a composite of length, character variety, and common-pattern penalties. Below 30 is weak (cracked in seconds to minutes), 30–59 is fair (hours to days), 60–79 is strong (months to years), and 80–100 is very strong (centuries or more at a typical GPU attack rate). It is a relative index, not a guarantee.
How is password entropy calculated?
Entropy = length × log₂(pool size), where the pool is the number of distinct characters an attacker must guess from. Lowercase only gives a pool of 26; adding uppercase brings it to 52; adding digits reaches 62; adding common symbols reaches roughly 94. A password that uses 4 classes has about 3.6× the pool of a lowercase-only password at the same length.
Why is password weaker than its entropy suggests?
The raw entropy model gives an 8-letter lowercase word like password about 37.6 bits and a score near 49. But real-world attackers do not brute-force every possibility — they start with dictionaries, and password is the most common word on Earth. Tools like zxcvbn apply heavy penalties for dictionary hits, dropping the effective score close to 6. Length alone is not enough if the word itself is predictable.
Is it safe to type my real password here?
Yes. All scoring runs locally in your browser using the formula described above; nothing is uploaded. As a habit, however, you should never type a real password into a site you do not trust, and you should use a unique password for every account.
How long should a password be?
At least 12 characters for everyday accounts and 16+ for email, banking, and anything tied to money. Prefer long random strings or multi-word passphrases over short strings with heavy symbol substitution, because length multiplies entropy while clever substitutions add only a little.
What is a realistic offline attack speed?
A single modern GPU can test on the order of 10 billion guesses per second against unsalted hashes like NTLM or MD5. A botnet or rented cloud cluster can push this to 1 trillion or more. The default 10 billion is a fair middle ground; raise it to model a serious adversary.
Does changing a dictionary word into leet (like P@ssw0rd) help?
A little, but not much. Attackers precompute leet substitutions as part of their dictionary, so P@ssw0rd falls almost as fast as password. The reliable win is longer length and true randomness, not character trickery.
Disclaimer
This password strength checker is provided for informational purposes only and does not create a security guarantee or professional security audit. Crack-time estimates are mathematical averages based on the charset-pool model and the attack rate you enter; real-world attacks use dictionary rules, pattern detection, and leaked credential databases that can bypass pure brute force. Always use a password manager, enable multi-factor authentication on important accounts, and follow your organization's security policy.