Password Strength
Entropy, crack-time estimates and warnings.
About the Password Strength
Test a password's real-world strength with entropy estimation, unique character counts and crack-time projections at three attacker speeds โ throttled online at 100 guesses per second up to an offline GPU rig at 100 billion per second. A warning list flags common passwords, sequences and repeated characters.
How to use the Password Strength
- Type or paste the password into the field โ analysis stays local.
- Read the entropy in bits and the verdict from Very weak to Excellent.
- Check the crack-time table for the three attacker scenarios.
- Review the warnings below for specific weaknesses to fix.
Password Strength FAQ
How is entropy calculated?
Length times the log2 of the character pool used โ 26 for lowercase, 26 for uppercase, 10 for digits and 33 for symbols โ then reduced by penalties for repeats, sequences and digit-only passwords.
What do the crack times mean?
They estimate time to a 50% chance of guessing the password at 100 guesses per second for a throttled login, 10,000 for an unthrottled endpoint, and 100 billion per second for an offline GPU attack.
Why did a long password still score badly?
Structure matters: one of the most common leaked passwords caps entropy at 8 bits regardless of length, and keyboard sequences, tripled characters or digits-only content subtract further points.