What this calculates
Type a password and get an entropy estimate in bits — based on its length and which character classes it uses — translated into a rough time-to-crack under three different attack scenarios. It also checks the password against a handful of well-known weak patterns that a pure entropy number completely misses.
Why entropy alone can be misleading
The standard entropy formula — length × log₂(character pool size) — treats every character as if it were chosen independently and uniformly at random. That's exactly true for a password from a CSPRNG (see Password Generator), and completely untrue for a password a person actually picked. P@ssw0rd123 scores well by the formula alone — mixed case, digits, a symbol, eleven characters — while being one of the first few thousand guesses in any real password-cracking wordlist, because it's just "password" with the substitutions everyone makes. This tool runs a few pattern checks specifically to catch that gap: common passwords (with common leetspeak substitutions and trailing digits stripped before comparing), repeated characters, keyboard-adjacent runs like qwerty, sequential runs like 1234, and embedded years.
Where the crack-time numbers come from
The three attack scenarios use illustrative, order-of-magnitude guess rates for 2025-era hardware, not a precise benchmark of your specific situation:
- Online, rate-limited (10 guesses/sec) — a real login endpoint with reasonable rate limiting.
- Offline, fast unsalted hash (~100 billion guesses/sec) — a single high-end GPU cracking a leaked MD5 or unsalted SHA-256 hash. A real RTX 4090 benchmarks at roughly 150 billion MD5 guesses/second in hashcat.
- Offline, slow hash (~10,000 guesses/sec) — bcrypt or Argon2 used properly, which is precisely why these algorithms exist: the same RTX 4090 only manages around 180,000 bcrypt guesses/second even at a low cost factor, and a properly configured higher cost factor cuts that further.
The gap between the second and third row is the entire reason password hashing algorithms exist instead of just using a general-purpose hash function.
FAQ
Is my password uploaded anywhere?
No — everything here runs entirely in your browser. Nothing is logged or sent anywhere.
Should I use this to check my actual, real password?
It's safe to (nothing leaves your device), but the more useful habit is generating a new password with Password Generator instead of trying to strengthen an existing one — a password you can remember is, definitionally, one with structure this tool (or a real attacker) can exploit.
This tool didn't flag my password as weak — does that mean it's safe?
Not necessarily. This checks a small, fixed set of well-known patterns — it has no dictionary of real words, names, or phrases, and can't know if your password is personally guessable (a pet's name, a street address). A clean result here means "no obvious red flag," not "cryptographically random."