How is password strength measured?
Strength is really a measure of how many guesses an attacker needs, expressed in bits of entropy — each extra bit doubles the work. The arithmetic is length × log2(pool size), so length buys far more than complexity does: a 16-character lowercase passphrase beats a 9-character password with every symbol on the keyboard. The catch is that entropy assumes the password was chosen randomly. A human-picked password matching a common pattern falls to a wordlist in seconds no matter what the maths says, which is why this tool reports pattern warnings alongside the score.
How to use this tool
- 1 Type or paste a password — use the eye button to reveal it if you need to check it.
- 2 Watch the entropy figure and the meter; anything under 60 bits is weak against an offline attack.
- 3 Check which character sets are lit up, and the pool size they add up to.
- 4 Read the warnings — they catch patterns that entropy alone scores far too generously.
Frequently asked questions
Is my password sent anywhere?
No. Every calculation runs in JavaScript on this page — there is no network request of any kind, no analytics event carrying the value, and nothing stored. You can open DevTools and watch the network tab stay empty, or disconnect entirely and keep using it.
How is the crack time calculated?
It assumes 10 billion guesses per second, which is a realistic rate for an attacker with consumer GPUs attacking a fast hash like unsalted SHA-256. Against a slow hash designed for passwords — bcrypt, scrypt or Argon2 — the same attacker manages thousands per second, so the real time would be millions of times longer.
Why does adding symbols help less than I expected?
Because entropy scales linearly with length but only logarithmically with pool size. Going from lowercase-only to every printable character roughly doubles the pool, which adds about one bit per character. Adding four more characters to a lowercase password adds about nineteen. Length is simply the cheaper lever, which is why a long passphrase beats a short password bristling with punctuation.
Is this as accurate as zxcvbn?
No, and the gap is worth understanding. This tool measures raw entropy — length times log2 of the pool — so it scores "Tr0ub4dor&3" at around 72 bits and calls it strong. zxcvbn scores the same string at roughly 28 bits, because it recognises "troubadour" as a dictionary word and 0-for-o and 4-for-a as predictable substitutions, then counts how many guesses a cracker running those rules would actually need. Raw entropy is an upper bound that assumes the password was chosen at random; the moment a human picked it, the real number is lower. Read the warnings below the score as the correction to it.
How many bits of entropy is enough?
Under 40 bits falls quickly to an offline attack. 60–80 bits is reasonable for an account protected by rate limiting. Above 100 bits is out of reach of any realistic offline attack. For anything you actually care about, a password manager generating 20+ random characters puts you well past all of these.