Password Strength Checker
Estimate how strong a password is by its entropy — the number of bits of randomness — and how long a modern attacker would take to crack it by brute force. Everything runs in your browser; your password is never transmitted or stored.
How to use this calculator
- Type or paste a password to analyze.
- Read the entropy (bits) and estimated brute-force crack time.
- Aim for 60+ bits for important accounts — length matters more than symbol soup.
Formula used
The character pool is 26 (lowercase) + 26 (uppercase) + 10 (digits) + ~33 (symbols) = up to 95. Each added character multiplies possibilities by the pool size, so length raises entropy far faster than adding one special character does.
Example calculation
Tr0ub4dour&3: 12 characters, full 95-symbol pool → ~79 bits, cracking in millennia by brute force.
But the famous XKCD point holds: a random four-word passphrase like correct-horse-battery-staple is both stronger and far easier to remember than a short symbol-jumbled password.
Entropy vs the passwords attackers actually try
Entropy measures brute-force resistance — how many guesses to try every combination. Each bit doubles the work, so 60 bits is a billion times harder than 30. Length dominates this math: a 16-character lowercase-only password (~75 bits) beats an 8-character everything-goes one (~52 bits) decisively.
The critical caveat: real attacks aren't pure brute force. They start with leaked password lists, dictionary words, names, dates and predictable substitutions (P@ssw0rd). A high-entropy password built from a common word plus a year is far weaker than its bit count suggests. The genuine fixes are randomness and length — a passphrase of random words, or better, unique random passwords from a password manager.
Why use this calculator?
- See entropy and crack time to understand why length beats complexity.
- Test password ideas privately — the check runs entirely in your browser.
- Learn why passphrases outperform short cryptic passwords.
Frequently asked questions
How long should my password be?
At least 12–16 characters for important accounts; longer is better. A random passphrase of 4–5 words is both strong and memorable. Length adds entropy faster than swapping letters for symbols.
Is a complex short password better than a long simple one?
Usually no. A 16-character passphrase carries more entropy than an 8-character symbol jumble, and it's easier to remember. Attackers expect the P@ssw0rd-style substitutions, so they add little real security.
Is it safe to type my password here?
This tool analyzes it purely in your browser with JavaScript — nothing is transmitted, logged or stored. Still, as a universal habit, never enter a real password into any online tool you don't fully trust. Test a similar structure instead if unsure.