Password Strength & Entropy Meter
Measure password length, character variety, common-password matches, predictable patterns, and estimated crack times. Analysis happens entirely in your browser.
Check a password
The password is not sent, logged, or saved anywhere.
Start typing to measure length, character variety, patterns, and estimated crack times. The password never leaves this page.
Composition checks
Estimated crack times
Rough guesses based on the estimated entropy and common attack speeds.
These estimates are illustrative, not a guarantee. Real attack speeds depend on the hashing algorithm, hardware, rate limits, password reuse, and the attacker's wordlists.
Feedback
Warnings
Suggestions
How password strength is estimated
Entropy is a rough measure of unpredictability, usually expressed in bits. More bits generally mean more guesses are required. A long random password has more entropy than a short one, but length alone is not enough: repeated characters, keyboard runs, dates, dictionary words, and common passwords drastically reduce the real number of guesses an attacker needs.
This meter combines a character-pool estimate with pattern penalties. It checks a bundled list of common passwords and common words, including simple leetspeak substitutions such as @ for a and 0 for o. It also reduces the score for repeated blocks, repeated characters, alphabetic or numeric sequences, keyboard patterns, and obvious years. The result is a heuristic, not a formal audit of a specific hash or attack.
Length beats complexity
For most people, a long passphrase is easier to remember and stronger than a short password with a few symbol substitutions. Four to six randomly chosen words can produce excellent entropy, especially when the words are not a famous phrase. If you use a password manager, let it generate a random password of at least 16 characters, and never reuse it across sites. A password manager also removes the need to memorize every password.
Why common passwords fail
Attackers do not guess one password at a time from scratch. They use lists of leaked and commonly chosen passwords, plus rules that add years, capital letters, symbols, and keyboard patterns. A password such as P@ssw0rd2025! looks complex but follows a predictable recipe and can be cracked quickly. The composition checks in this tool are a useful guide, but they cannot replace a unique password and multi-factor authentication.
What this tool does not do
- It does not test whether a password has appeared in a breach service; that would require sending data to a server.
- It does not guarantee that a password is safe against every attacker or every hashing method.
- It does not store, log, or transmit the password.
- It does not replace a password manager or multi-factor authentication.