● checked entirely in your browser, never sent anywhere
Password strength checker
Type a password to see its strength and estimated crack time. Nothing is transmitted — check your browser's network tab if you want proof.
How it works
Strength is estimated as Shannon entropy: the character pool size is set by which types of characters appear (26 lowercase, 26 uppercase, 10 digits, 32 symbols) and multiplied by length to get bits of entropy (length × log2(pool size)); the estimated crack time then assumes an offline attacker guessing 10 billion passwords per second and needing on average half the total keyspace to find yours.
FAQ
Why does adding one extra character make such a big jump in crack time?
Because entropy grows exponentially with length - each additional character multiplies the total number of possible passwords by the character pool size, and the estimated time to guess it all scales the same way.
Does a long password automatically pass the 'not a common password' check?
No - that check only rejects passwords that literally start with one of five hardcoded strings (password, 123456, qwerty, letmein, admin); it isn't checking against a real breach database, so a long but still commonly-known password could still score as strong here.
Free, unlimited, no account. If this saved you a paid tool, a small thanks is appreciated.