Analyse password strength, Shannon entropy, and crack time estimates locally.
Loading tool
About Password Strength Analyser
Estimates how strong a password is from its length, character set and detected patterns. It reports charset entropy (length x log2 of the character pool), Shannon entropy, an effective entropy after penalties for common words, keyboard patterns, sequences, repeats and years, and the average brute-force time at five attack speeds from a throttled online login to an offline GPU cluster. The password is analysed in your browser and never leaves the page.
Common uses
- Check whether a password is long enough before using it
- See why a password that meets complexity rules is still weak
- Compare crack time against fast and slow (bcrypt-style) password hashes
- Explain password entropy to a team with concrete numbers
FAQ
- How is password entropy calculated?
- For a randomly chosen password, entropy in bits is length x log2(size of the character set). For example, 12 random characters from the 94 printable ASCII symbols give about 12 x 6.55 = 78.7 bits.
- Does this check if my password was leaked in a data breach?
- No. The analysis is local and makes no network requests, so it cannot query breach databases. It only flags a short built-in list of very common passwords and words.
- Why does a password like 'Summer2024!' score low?
- It follows the predictable Word + digits + symbol pattern and contains a year. Attackers try these structures first, so the tool reduces its effective entropy.
- How accurate is the crack time?
- It is a rough average for brute force at the listed guess rates. Real attacks use dictionaries and rules, so patterned passwords fall much faster, while slow hashes like bcrypt slow attackers down a lot.