Password Strength Checker — entropy, crack time, offline breach check

Real-world use cases

• Vetting a new admin password before you save it

  You are about to set the root password for a production database. You type a candidate here first. The tool shows 38 bits of entropy and flags a trailing "2024", so you swap to a 5-word passphrase and watch entropy jump past 80 bits. Now the offline-GPU estimate moves from minutes to centuries before you commit it.

• Teaching a team why "Summer2024!" is not strong

  During a security onboarding, a new hire insists their password is complex because it has upper, lower, a digit and a symbol. You paste it here live: the breach list flags the season+year pattern and crack time reads under a second for an offline attacker. The concrete number ends the argument better than a policy slide ever could.

• Choosing a master phrase for a password manager

  You are migrating to a vault and need one phrase you can actually remember for years. You test candidates here until you find a 5-word combination plus a digit that lands above 90 bits and survives the offline model at decades-to-crack. Because nothing leaves the tab, you are not seeding your future master phrase into any server log.

• Auditing a reused password you already have

  You suspect an old password is too weak but do not want to type it into a random website. This tool runs fully offline, so you check it safely: it reports 44 bits and a keyboard-sequence penalty for the "qwerty" fragment. That is enough signal to rotate it everywhere it was reused, starting with email and banking.

Common pitfalls

• Judging strength by length alone. A 16-character "aaaaaaaaaaaaaaaa" has almost no entropy; this tool penalizes the repeat run, so watch the entropy bits, not the character count.

• Trusting l33t substitutions like "P@ssw0rd". Attackers apply these mangling rules by default, so the breach check still flags it. Use unrelated random words instead.

• Reading only the web-login crack time. The "1,000 guesses/sec" number assumes rate limiting; for a leaked hash use the offline GPU figure, which can be billions of times faster.

Privacy