Password Strength Checker

How the estimate works

Entropy = length × log₂(character-pool size), with penalties for common patterns: dictionary-style words, years, sequences (1234, abcd), repeats and keyboard runs (qwerty). Crack time assumes an offline attacker testing 10 billion guesses per second — modern GPU hardware against fast hashes.

Frequently asked questions

Is it safe to type a real password here?

The check runs locally in JavaScript with no network requests — nothing is sent or stored. Still, best practice is to check a password like yours rather than the exact one you use.

What actually makes a password strong?

Length beats cleverness: Tr0ub4dor! is weaker than four random common words. Every extra character multiplies the search space; a symbol substitution barely does. 16+ characters or a 4–5 word passphrase is the practical bar.

Why do sites still ask for symbols and uppercase?

Legacy composition rules predate modern guidance. NIST now recommends length and a breached-password check instead of forced complexity — but until sites catch up, a long passphrase with one capital and one symbol satisfies both worlds.