Password Strength & Entropy Checker

Password strength is really a statement about entropy — how many equally likely possibilities an attacker would have to search. This tool estimates entropy from the character pool you draw on and the length, reports the raw keyspace, and translates it into crack-time estimates at three attacker speeds, then flags obvious weaknesses.

How the estimate works. The character pool is the sum of the classes you use: 26 for lowercase, 26 for uppercase, 10 for digits, ~33 for common symbols. Entropy in bits is length × log2(pool). A 12-character password over the full 95-character printable ASCII set carries roughly 78 bits — comfortably strong — while an 8-character lowercase-only password carries about 38 bits, which a modern GPU rig clears quickly. Crack time is keyspace divided by guess rate; the three rates model an online-throttled attack, a slow offline hash, and a fast offline hash.

Important caveat. Entropy math assumes the password is random. A human-chosen password like Password1! scores well on pool size but is trivially guessed, because real attackers run dictionaries, keyboard walks, and leaked-password lists first — not brute force. That is why this tool also warns about single character classes, common passwords, digit-only strings, and repeated characters. Treat a high entropy score as necessary, not sufficient.

Worked example. A four-word passphrase such as correct-horse-battery-staple is long, memorable, and high-entropy if the words are chosen randomly. Reusing that exact famous example, however, is useless — it is in every wordlist. When you need a genuinely unpredictable password rather than a memorable one, the password generator draws every character from the browser's cryptographic RNG so there is no pattern to attack.

Defensive angle. For accounts, length beats complexity: encourage passphrases of 14+ characters and block known-breached passwords at signup rather than enforcing arbitrary symbol rules. On the storage side, never keep passwords recoverable — hash them with Argon2id or bcrypt and a unique salt (a plain SHA-256 digest is far too fast to be safe here), and add multi-factor authentication so a single leaked password is not game over. If you are auditing a system and find bare, unsalted digests protecting credentials, the hash identifier helps you recognise which fast algorithm is in use so you can flag it for migration.