Password Strength Analyzer
Analyze your own password locally — estimate character space and entropy, flag common or repeated patterns and rough brute-force times; your input is never sent anywhere.
>_ USAGE GUIDE
Analyze your own password locally: estimate the character space and entropy, flag whether it hits a common weak-password list or contains repeated and sequential patterns, and roughly estimate brute-force time. All computation happens in the browser and your input never leaves the device.
Understanding entropy makes the result easier to read: entropy is roughly the logarithm of the character-set size times the length, representing how many guesses an attacker needs on average — larger is harder. A key intuition follows: length matters more than complexity, since adding one character often raises entropy more than widening the character set. Also remember that dictionary and pattern attacks (keyboard runs, dates) are far more efficient than pure brute force, so a "complicated-looking" password like P@ssw0rd may not be safe.
- Enter the password: type the one to evaluate, handled locally only
- Read entropy and strength band: see which band it falls into
- Review weak / repeated-pattern flags: note any matched common strings or patterns
- Act on the advice: lengthen first, then widen the character set
>_ FAQ
Q1 · How much entropy is considered safe?
A common reference is that 60 bits and up is fairly solid and 80 bits and up is very strong. Roughly, a 12-character random string with upper, lower and digits lands around the 60–70 bit range. Rather than memorizing a number, aim for "as long and as random as possible" and push entropy up.
Q2 · How accurate is the crack-time estimate and how is it computed?
It is an order-of-magnitude estimate, not a precise prediction. It takes the log of the total combinations (character space raised to the length) and divides by an assumed guesses-per-second rate to get an approximate time. Real attack speed varies with hardware, whether it is offline and whether dictionaries are used, so treat the figure as a relative comparison rather than an absolute verdict.
Q3 · Is it safe to type my real password here?
Yes. The assessment runs entirely in your browser, with no network request and no upload, and closing the page leaves nothing behind. It is designed for local computation, so even if the input is the password you currently use, it is never transmitted.
Q4 · What makes a password a common weak one?
Typical traits: all digits or all letters, too short a length, high-frequency words like 123456 or password, keyboard runs (qwerty), repeated characters (aaaa), common years or birthdays, and simple word mutations (P@ssw0rd). These patterns are the first to fall to dictionary and pattern attacks, so even a "complex-looking" one can crack quickly.
Q5 · How does it differ from the password generator?
They run in opposite directions: the generator produces a random strong password from a chosen length and character set, while this tool evaluates an existing password — how strong it is and where it is weak. Evaluate then improve, or generate a fresh one, are both reasonable paths.