What it does
Type or paste a password to get a rough estimate of its strength: the character sets it uses, its entropy in bits, and an approximate time to brute-force it at a few different attack speeds.
Nothing is ever sent anywhere — the password is analyzed entirely in your browser and is never transmitted, logged, or stored.
Try it
How it works
- The password is scanned to detect which character sets are present: lowercase, uppercase, digits, and symbols.
- The pool size is the sum of the sizes of those sets (e.g. 26 for lowercase-only, 62 for upper+lower+digits, etc.).
- Entropy (in bits) is estimated as
length * log2(poolSize)— this is a simplified approximation that assumes random character selection; real-world passwords with dictionary words or patterns are much weaker than this number suggests. - Estimated crack time divides
2^entropy(the total number of possible passwords) by an assumed guesses-per-second rate for a few scenarios (online throttled, offline fast hash, offline GPU cluster).
This is a rough estimate only — it does not check against leaked password databases, dictionary words, or common patterns (e.g. Password123! scores well on raw entropy but is actually very weak in practice).