Overview
Every password has two strengths: how strong it looks, and how strong it is. Attackers only care about the second. They don't admire your clever substitutions — they count the size of the search space and run through the dictionaries of human habits first. This tool thinks like they do, so you can see your password the way an attacker would before they ever do.
Type anything and three things happen at once: an entropy score derived from the password's real character pool, a crack-time estimate translated into plain language, and a list of specific warnings — common-password match, keyboard walks, repeats, short length. Fix what it flags, usually by adding length, and watch the grade climb.
What does the grade actually measure?
Two things: the raw search space, and how much of it attackers can skip. The search space is entropy — length times the logarithm of the pool size, in bits. Forty bits means about a trillion guesses on average; eighty bits means more guesses than stars you could ever count. That part is pure arithmetic and the checker shows its work.
The second part is human behaviour, and it's where most passwords die. A twelve-character password shaped like 'Password123!' has fine entropy on paper, but guessing software tries that exact shape early — dictionary word, capital first, digits and symbol at the end. The checker's warnings exist for this gap between maths and reality: common-password lists, sequence detection, and repeat-spotting.
Features
- Live entropy readout in bits, computed from the character families you actually used.
- Crack-time estimate in plain words — 'instantly' to 'millions of years' — at a realistic attack speed.
- Common-password detection against the internet's most-abused passwords, which are always tried first.
- Pattern warnings for keyboard sequences, alphabet runs, repeated characters and short lengths.
- Pool breakdown showing which character families appear and which are missing.
- Zero transmission: no network requests, no storage, no analytics on what you type — verify it in your browser's network tab.
Benefits
- See through the disguise. Learn whether a password is strong or merely looks strong.
- Fix the right thing. Each warning names a concrete weakness instead of vague advice.
- Experiment safely. Test ten candidates in a minute; nothing is recorded anywhere.
- Offline-capable. Once loaded, the page needs no connection at all.
Who can use it
Anyone choosing a password that matters — a new master password, a Wi-Fi key, an encryption passphrase, a login guarding money or email. It's also instructive: paste a retired password you no longer use anywhere and see how it scores. IT staff use it to show colleagues why 'Company2024!' was never the fortress it looked like.
How to use
- Type or paste a candidate password into the box at the top.
- Read the grade, entropy score and crack-time estimate as they update live.
- Work through the warnings one by one — each names a specific weakness.
- Strengthen the password (usually: make it longer) until warnings clear and the grade reads Strong or better.
- Generate the final version with a proper generator rather than hand-tuning — humans are bad random sources.
Frequently asked questions
Is it safe to type a password into this page?
Yes, because the page contains no code that could send it anywhere — open your browser's network tab and watch: zero requests as you type. Still, good hygiene says test candidates and retired passwords here, never a password currently guarding an important account.
What attack speed does the crack estimate assume?
Ten billion guesses per second — roughly one high-end graphics card against fast hashes. Well-designed slow password hashing cuts that drastically; a leaked database of fast hashes lets attackers go quicker. The estimate is deliberately conservative: assume the attacker is fast.
My password scored 'Fair' — is that enough?
For a throwaway forum account, probably. For email, banking, or anything that can reset your other accounts, aim for Strong or Very strong. The cheapest upgrade is nearly always length — four more characters beat almost any clever substitution.
Why was my long password flagged as weak?
Because it matched a known human pattern — typically a common password with tweaks, like 'Password123!', or a keyboard walk. Attackers keep dictionaries of exactly these shapes and try them early, so the checker warns you even when the raw entropy looks respectable.
Does a top grade mean the password can't be broken?
No grade can promise that. Strength only covers guessing — it says nothing about phishing, malware on your device, or a site storing passwords carelessly. A strong, unique password plus two-factor authentication is the combination that actually holds up.
Conclusion
Strength is arithmetic plus honesty about human habits. Run candidates through the checker, fix what it flags — usually by adding length — and stop trusting passwords that merely look complicated.