Password Strength Checker

The password stays in this tab. There is no network request, no storage and no analytics on the field. The code runs entirely in your browser, and you can confirm that in the network panel of your developer tools.

Each bit doubles the number of guesses needed. A 40 bit password takes about a trillion attempts, which sounds like a lot until you realise fast hardware manages billions per second. Every extra bit costs the attacker twice as much.

Length multiplies the search space faster than character variety does. Five random words are stronger than eight characters of alphabet soup, and easier to remember. This is why passphrases keep coming up in modern advice.

It is a realistic figure for an offline attack on a fast hash like MD5 or SHA-1 with modern GPUs. Against bcrypt or Argon2 an attacker gets far fewer, and against a well built login form with rate limiting, fewer still. The estimate deliberately assumes the worst case.

The weakness. Entropy assumes the password is random, and a real one usually is not. If your password is in a leak list, its entropy is irrelevant because the attacker will try it first.

Less than people think. They widen the pool, but adding four more characters helps more than swapping an a for an @. The substitutions everyone uses are already in every cracking dictionary.

No, and current NIST guidance says the same. Forced rotation pushes people toward Password1, then Password2. Change a password when there is a reason to, use a different one everywhere, and use a password manager.

Use our password generator for a random one, or our API key generator when you need a token for a machine. Both use the browser's cryptographic random source rather than Math.random.