Is a long password always a strong one? Not quite, but length matters more than most people think. The Password Strength Checker rates a password by its character mix and length, then estimates its entropy and a rough crack time.
This tool is for anyone picking a new password and curious how it scores. You type into the box, and the rating, the entropy in bits, and a crack-time guess update in your browser. The password is never sent to a server.
Table of Contents
- What the Tool Measures
- How to Use the Password Strength Checker
- How the Score Is Calculated
- Worked Example
- How to Read the Results
- What the Tool Does Not Check
- Limitations and Assumptions
- FAQs About the Password Strength Checker
What the Tool Measures
The tool looks at two things: how long the password is and which character types it uses. From those it builds a single entropy score. It does not read a dictionary or a list of leaked passwords.
- Strength Level: a word rating, from Weak to Very Strong.
- Entropy Score: an estimate in bits, based on length and character mix.
- Est. Crack Time: a rough guess at brute-force time.
- Toggle Visibility: a button that shows or hides the typed text.
The four character groups are lowercase, uppercase, digits, and symbols. Using more groups raises the entropy for the same length.
How to Use the Password Strength Checker
- Type or paste a password into the Test Your Password box.
- Read the Strength Level card for a quick word rating.
- Check the Entropy Score to see the estimated bits.
- Look at Est. Crack Time for a rough brute-force guess.
- Press Toggle Visibility to show or hide the characters.
The box starts with a sample password so you can see a filled result. Clear it and test your own.
How the Score Is Calculated
The tool adds up a character pool based on the groups you use. Lowercase adds 26, uppercase adds 26, digits add 10, and any symbol adds 32. The entropy is the password length times the log base 2 of that pool.
It then assumes an attacker tries 10 billion guesses per second. The crack time is the full number of combinations divided by that rate. The flow below shows the chain.
Character Pool×Length (log base 2)→Entropy in Bits→Rating + Crack Time
The ratings follow fixed bit thresholds. Above 80 bits reads Very Strong, above 60 reads Strong, above 40 reads Moderate, and anything else reads Weak.
Worked Example
Suppose Jordan tests the password Tiger7# which uses all four character groups, so the pool is 94.
| Step | Value |
|---|
| Length | 7 characters |
| Character Pool | 26 + 26 + 10 + 32 = 94 |
| Entropy | 7 times log2(94), about 46 bits |
| Strength Level | Moderate |
| Est. Crack Time | about 2 hours |
Change nothing but the length, and the numbers move fast. Adding a few more characters can push the same mix from Moderate up to Strong.
How to Read the Results
Entropy Score is the core number. More bits means more possible passwords, which is harder to guess. Each extra bit roughly doubles the search space.
Strength Level turns the bits into a plain word. It is a guide, not a promise, since the rating comes only from length and character mix.
Est. Crack Time assumes a fast offline attack at 10 billion tries per second. Online logins are usually far slower, so real attacks differ.
What the Tool Does Not Check
The tool does not know if your password is common. It will rate Password123# on its character mix alone, even though that pattern appears on every leak list. A dictionary word scores by its letters, not by how guessable it is.
It also misses repeats, keyboard runs, and names. So a high score here is a starting point, not a safety guarantee. Pairing a long random password with a manager is the stronger habit. You can build one with the password generator or a random string generator.
When you store user passwords in an app, hash them with a slow scheme like the bcrypt hash generator rather than a fast one. For other options, see the password hash generator and the full developer tools hub.
Limitations and Assumptions
- The score uses only length and character groups, not dictionaries or leak lists.
- Any non-alphanumeric character counts as a symbol and adds 32 to the pool.
- The crack time assumes 10 billion guesses per second, a fast offline rate.
- Entropy and crack-time numbers use US formatting, so large values show a thousands comma.
- An empty box reads Empty, zero bits, and instant, with the prompt Enter a password to see its strength.
- A high rating is not a guarantee of safety, and the result is for guidance only.
FAQs About the Password Strength Checker
What Is Password Entropy?
Entropy estimates how many guesses an attacker needs, measured in bits. More bits means more possible passwords. This tool finds it from the password length and the size of the character pool.
Why Did a Long Common Word Score Well?
The tool rates only length and character mix, not whether the word is common. A dictionary word can look strong here yet fall fast to a real attack. Avoid words that appear on leak lists.
How Many Bits Make a Strong Password?
In this tool, above 60 bits reads Strong and above 80 reads Very Strong. As a habit, aim for a long passphrase or a random string well past 12 characters.
Is My Password Sent Anywhere?
No. The check runs in your browser, and the text is not uploaded. Still, it is wise to avoid typing a real production password into any website.
Why Does the Crack Time Seem So Fast or So Slow?
The time assumes 10 billion guesses per second, which fits a strong offline attack. Real online logins are far slower due to rate limits. Treat the number as a rough guide.
Does Adding One Symbol Really Help?
It helps a little by growing the pool, but length helps more. Each extra character multiplies the possible combinations, so a longer password beats one extra symbol most of the time.
This calculator gives general estimates only and is not professional advice. Reviewed for general accuracy by Prof. Dr. Khalil Mudassar, PhD.