Password strength & crack-time
Check how strong a password really is, with honest estimates of how long it would take to crack under different kinds of attack. The model is transparent and makes no false promises — and your password is checked entirely in your browser, never sent anywhere.
This is a transparent estimate: entropy = length × log₂(character-set size), reduced by penalties for common passwords, sequences, and repeats. Guess rates are stated assumptions (see the table notes), not measurements. A determined attacker with a good wordlist and rules may crack a “reasonable” password faster than shown — treat these as a guide, not a guarantee.
What actually makes a password strong
- Length beats complexity. Each extra character multiplies the work far more than swapping a letter for a symbol. A long passphrase usually beats a short cryptic string.
- Uniqueness matters most. A password reused across sites is only as safe as the weakest site that stores it. Breached-credential reuse is the number-one way accounts fall.
- Randomness beats patterns. Words, dates, and keyboard walks are in every wordlist. Generated random strings are not.
- Storage decides the outcome. Even a great password is at risk if the service hashes it with fast, unsalted MD5. That is a system-side finding, not a user error.
Password strength, explained
How is password strength calculated?
It estimates entropy — the number of bits of unpredictability — as the password length multiplied by the log base 2 of the character-set size, then subtracts penalties for weaknesses a real attack exploits: being a common password, using a single character class, keyboard or alphabet sequences, and repeated characters. Higher entropy means more guesses to crack.
How are the crack times worked out?
For each attacker scenario we assume a guessing rate (shown in the table) and divide the average number of guesses — half the keyspace — by that rate. The scenarios range from a rate-limited login at about 10 guesses a second to a multi-GPU rig against fast, unsalted hashing at around 100 billion a second.
Why do the same passwords crack instantly in one column and take years in another?
Because the attack model matters far more than the password alone. A strong password behind slow, salted hashing (bcrypt) can be safe for years, while the same password behind fast, unsalted MD5 in a stolen database can fall in hours. That gap is why how a system stores passwords is as important as how users choose them.
Is my password sent anywhere?
No. The entire calculation runs in your browser in JavaScript. Nothing you type is transmitted, logged, or stored. As good practice, avoid testing a password you currently use elsewhere.
Should I trust this over a password manager?
Use it as a guide, not a guarantee. This model is deliberately simple and can be optimistic against a skilled attacker with a tailored wordlist. The strongest practical advice is unchanged: use a password manager to generate long, unique, random passwords for every account, and enable multi-factor authentication.
Is your app storing passwords safely?
Weak password storage and missing account-lockout controls are common penetration-test findings. Compare independent, accreditation-verified UK penetration testing companies in our directory.
Browse the directory