How is strength computed?

We compute raw entropy as log2(charsetSize) × length, then subtract penalties for common words, sequential characters, repeats, years, and lowercase-only or digits-only patterns. The result is mapped to Weak/Fair/Good/Strong.

Is my password sent anywhere?

No. Everything runs in your browser. There is no network request. Still, if you're cautious, test a similar password rather than your real one.

Why does my password show as Weak?

Likely because it's short, uses a limited character set, or contains a common word or sequence. The tips list the exact reasons — fix them one at a time and watch the meter climb.

What's the crack-time estimate based on?

It assumes an offline attacker with fast hardware making 10 billion guesses per second — a realistic worst case for hashed database breaches. Online attacks are far slower thanks to rate limits.

Does a Strong rating mean my password is safe?

It means it resists brute force. You should still never reuse passwords, and use a password manager so each site gets a unique one.

Why no zxcvbn-style dictionary modeling?

To keep the tool dependency-free, we use a small common-password list plus pattern heuristics. For high-strength modeling, dedicated libraries like zxcvbn go deeper.

Password Strength Checker

Estimate entropy and crack time for any password — fully offline.

100% private — no uploads Security & Crypto ToolsFree & unlimited Read tutorial

See how it works

Watch a quick simulation of this tool in action — no file needed.

How to use Password Strength Checker

Follow these steps — everything happens instantly in your browser.

1
Step 1. Type or paste the password you want to evaluate.
2
Step 2. Read the strength meter (Weak / Fair / Good / Strong) and entropy in bits.
3
Step 3. Check the estimated time to crack under an offline fast attack.
4
Step 4. Apply the listed suggestions to improve the password.