Password Strength Checker — Free Entropy Analysis Tool
Paste or type an existing candidate to see estimated entropy, crack-time bands, and what to change. This is an audit of a string you already have, not a generator. It cannot see breach corpora by itself. If the account is important, also run the HIBP checker and put the keeper in a manager.
What the password strength checker is for
Composition rules — one capital, one number, one symbol — measure the wrong thing. They reward patterns attackers try first, which is why a password can satisfy every rule and still fall in seconds.
Entropy measures the actual guessing effort required, and it consistently shows that length matters far more than punctuation.
Common uses
- Deciding whether an existing password needs replacing
- Comparing a passphrase against a shorter complex password
- Demonstrating why complexity rules mislead
- Sanity-checking a proposed password policy
What the output means in the real world
The verdict and the advice lines tell you whether to keep, lengthen, or replace the candidate. Follow the advice (add length, drop the year, stop reuse), then store the final secret in a vault. Clear the field when you are done. Do not paste a work password into this box on a shared kiosk.
How this fits into real work
The meter page is the live while-you-type gauge. This checker is the 'should I keep what I already use' pass, with explicit improvement text for people who will not read a score alone.
Corporate annual 'password health' campaigns fail when they only say 'use a symbol'. Concrete crack-time language changes behaviour more than a colour bar.
A strong unique password plus reused-elsewhere is still a stuffing target. Strength without uniqueness is incomplete. Pair with HIBP.
How to use this tool
- Type a password, ideally one shaped like yours rather than the real thing.
- Read the entropy in bits and the estimated crack time.
- Add characters and watch the numbers rise — that is the practical lesson.
- Act on the suggestions listed beneath the score.
Tips
- Entropy assumes randomness; a dictionary word is much weaker than its length implies.
- Crack times assume offline attack on a stolen database, which is the scenario that matters.
- Anything under 40 bits should be replaced immediately.
Privacy & how it works
Everything happens inside your browser. The values you type are held in page memory only, are never sent to a server, and disappear when you close the tab. You can confirm this by opening your browser's network tab and watching it stay silent while the tool runs — or by disconnecting from the internet and using the tool offline. Test a similar-shaped password rather than a live credential where you can.
Frequently asked questions
- Why does my password meet every rule but score badly?
- Because composition rules measure shape, not unpredictability. Substituting characters and appending a digit are standard cracking rules, so they add almost nothing to real strength.
- What score should I aim for?
- At least 60 bits for ordinary accounts, and 80 or more for email, banking, and anything administrative.