Password Strength Checker

Features

• ⚠️ The first line of the page tells you not to use a real password — the one place this tool could do actual harm
• Two entropy figures: the raw one from length and charset, and the effective one after pattern penalties
• Common-password detection that sees through case changes, leet substitutions like p@ssw0rd, and insertions like pass-word
• Pattern detection: keyboard walks (qwerty), runs (abcd / 4321), years and dates, repeats (aaa / ababab) and leet substitutions
• Five attack scenarios with their own times: online rate limited, online unlimited, offline slow hash (bcrypt and friends), offline fast hash on one GPU, and a GPU cluster — each labelled with its assumed rate
• Several candidates at once, grouped per line for comparison
• A password on the common list is called “no protection at all” however high its entropy looks

How to use

1. ⚠️ Do not paste a real password first — use something with the same shape
2. Paste the candidates, one per line
3. Read the effective entropy and the patterns found, then compare the five crack times below

FAQ

Is this page safe? Can I type my real password?

Technically yes, but please do not. The page is static, the input is used only inside your browser and no request is made — you can confirm that in your browser’s network panel. But the page itself came from the network, and you cannot verify it was not altered in transit. A password strength page naturally invites real passwords, and that is its only real risk. A structurally similar stand-in gives the same verdict.

Why is the entropy formula not enough?

Because entropy only sees length and character set — it cannot tell whether the string means something. `Password1!` is 9 characters across all four classes, about 59 bits by the formula, which looks fine — but it is `Password` with `1!` appended, and it is on the first page of any attacker’s dictionary. Conversely `qwertyuiop` is 10 lowercase characters, about 47 bits, and it is one row of the keyboard. So the common list and the pattern penalties come first: subtract what a person could guess, and only what remains counts as entropy.

Why do the crack times differ so much?

Because the cost of one guess varies by ten orders of magnitude. Online endpoints are usually rate limited (ten per second), so every extra bit pays off enormously. Once an attacker holds the hashes from a database breach they can work offline at hundreds of billions of guesses per second — and the same password falls almost instantly. That is also why the hash algorithm matters more than password length: bcrypt, scrypt and Argon2 are deliberately slow, dragging “a hundred billion a second” back down to “ten thousand a second”.

My password says “very strong” — am I safe?

Not necessarily. This verdict covers offline exhaustive search only. Real-world risk also includes: the same password having leaked from another site (this tool cannot see breach lists), phishing, keyloggers, and malicious browser extensions. A password manager plus two-factor authentication is worth more than any strength score.