What this tool does
A password strength estimate is more useful when it explains whether the candidate is weak, predictable or reasonably strong before you adopt it. This page helps you compare options locally without sending the password to an external checker.
- Calculates the entropy of a password in bits based on character set size and length, giving a more objective measure than colour-coded strength meters.
- Estimates the theoretical time to crack the password under brute-force conditions at various speeds.
- Helps developers and security reviewers evaluate password policies, generated passwords and user-facing requirements with concrete numbers.
How to use it
- 1
Type or paste the password you want to evaluate into the input field.
- 2
Review the entropy value in bits and the crack time estimate.
- 3
Compare different candidate passwords to understand the impact of length and character variety.
- 4
Use the result to justify or adjust password policies, generator settings or user-facing requirements.
Example
A security engineer evaluates two passwords during a policy review: a 12-character mixed-case alphanumeric password versus a 16-character lowercase phrase, and compares entropy to decide the minimum length requirement.
Candidate A: Tr0ub4dor&3 / Candidate B: correcthorsebatterystapleCandidate B has higher entropy despite using simpler characters because of its significantly greater length.Use cases
- Comparing candidate passwords before adoption in an internal workflow.
- Teaching users or teammates why a password is weak or predictable.
- Evaluating generated passwords during security or onboarding tasks.
Common mistakes
Confusing complexity with entropy
A short password with symbols can have lower entropy than a long password using only lowercase letters. Length has a greater impact than character variety.
Using entropy alone as a security guarantee
High entropy means the password is hard to brute-force. It does not protect against phishing, credential stuffing or reuse across services.
Testing real production passwords
Even though analysis runs locally, avoid testing actual passwords you use in production systems. Use representative examples instead.
FAQ
What entropy is considered secure?
Security researchers commonly suggest at least 60 bits for personal accounts and 80 or more for high-value or long-lived credentials, but requirements vary by threat model.
Does length or character variety matter more?
Length has a larger impact. Doubling the length roughly doubles the bits of entropy, while adding a character class adds a comparatively small amount.
Is the crack time estimate realistic?
It is a theoretical estimate based on assumed attack speeds. Real-world crack times depend on hardware, the hashing algorithm protecting the stored password and attacker resources.
Does this tool send my password anywhere?
No. Analysis runs entirely in the browser.
Can I use this to justify a password policy?
Yes. Entropy values give a concrete basis for setting minimum length requirements and making the case for longer passphrases over short complex passwords.
Privacy and security
- Password analysis runs locally in the browser.
- No password is uploaded to a remote strength-checking service.
- That matters because even test credentials should stay off third-party pages when possible.
Related tools
Related tools for the next step in the same workflow:
Next step
Check the candidate locally, then continue with adjacent security tools if you still need hashes, keys or credential helpers.