Password Strength Checker

What "strong" actually means

A password is strong when guessing it costs more than it is worth. That cost is measured in entropy: the base-2 logarithm of how many passwords an attacker would have to try. The formula this page uses is the standard one — entropy = length x log2(pool size) — where the pool is the set of characters your password draws from. Lowercase adds 26 possibilities per position, uppercase another 26, digits 10, and printable symbols about 33. Use all four and the pool is 95.

The crucial part is that length is an exponent and the pool is only the base. Every extra character multiplies the total number of candidates by the pool size, so an eight-character password from the full 95-character pool has 95^8 combinations, roughly 6.6 quadrillion, which is 52 bits. That sounds enormous until you price it: a rig of consumer GPUs attacking a fast hash does about 10 billion guesses per second, so it needs around four days on average. Sixteen characters from the same pool gives 105 bits and would take longer than the age of the universe on the same hardware.

Worked example: eight characters versus sixteen

Take "Tr0ub4dor" style thinking. "Xk7#pQ2z" is eight characters, all four classes, so entropy is 8 x log2(95) = 52.6 bits. Average offline crack time at 10 billion guesses per second: 2^51.6 / 10^10 seconds, which is about four days. Now take "Xk7#pQ2zLm9$Rt4W" — the same style at sixteen characters. Entropy doubles to 105 bits, and the same attack needs about 2^104 / 10^10 seconds, or roughly 6.4 x 10^13 years. Nothing changed except length, and the answer moved from a weekend to longer than the sun will burn.

Worked example: the four-word passphrase

Now compare a passphrase drawn from a 7,776-word list, the standard Diceware set. Each word contributes log2(7776) = 12.9 bits, so four random words give 51.7 bits and six words give 77.5 bits. Four words are already level with that eight-character symbol soup — and a six-word phrase like "cargo ripple maple fondue verdict spiral" is around 77 bits, which at 10 billion guesses per second averages about 300 million years. The catch is that the words must be chosen randomly, by dice or software. A phrase you invented yourself, such as a song lyric, is worth a fraction of that because attackers seed their dictionaries with lyrics, film titles and sports chants.

Why this tool subtracts points

Raw entropy assumes every character was picked at random. Real passwords are not random, and cracking software knows it: John the Ripper and hashcat run rule-based attacks that append years, capitalise the first letter, substitute 3 for e and 0 for o, and walk keyboard rows. So the checker looks for those shapes and reduces the estimate accordingly. A common base word cuts the result hardest, because a dictionary attack tries all of them within the first few thousand guesses. Sequences (abc, 321), triple characters, keyboard runs (qwerty, asdfg) and four-digit years each shave a further slice.

That is why "P@ssw0rd2026" scores far worse than its twelve characters suggest. The pool is 95 and the raw figure is around 79 bits, but the leetspeak reverses to a top-ten dictionary word and the year is one of about 130 plausible options, so the realistic search space is tiny. The colour band you see reflects the reduced figure, not the flattering one.

Breach reality, and what this tool cannot see

Most accounts are not lost to brute force at all. They are lost because a password was reused on a site that got breached, and credential-stuffing bots replayed it everywhere else. Billions of username and password pairs circulate in combolists, and no amount of entropy protects a password that already appears in one. This checker works fully offline, so it cannot tell you whether your password has been exposed in a breach — it only measures structure. For that, use a service that checks with k-anonymity hashing, or better, let a password manager flag reused and breached entries for you.

Two more limits worth stating plainly. First, crack-time numbers depend entirely on the hash the site chose: 10 billion guesses per second is realistic for unsalted MD5 or SHA-1, while bcrypt at a sensible cost factor drops attackers to a few thousand per second, making even mediocre passwords survive. You do not control that choice, so plan for the fast case. Second, entropy says nothing about phishing, keyloggers or a leaked session token. Turn on two-factor authentication — an app or hardware key, not SMS if you can avoid it — and a compromised password stops being a compromised account.

Practical targets for 2026: 12 characters minimum for anything routine, 16 or more for email and banking, since email is the reset path for everything else, and unique everywhere. Aim for 60 bits and up on this gauge for accounts that matter, and treat anything under 36 bits as a placeholder you should replace today.