Password Strength Tester & Entropy Checker

How this password strength tester works

Most password checkers count character types. Add an uppercase letter, a number and a symbol, and the meter turns green. That’s not how passwords get cracked. Attackers don’t guess characters one at a time; they start with lists of leaked passwords, dictionary words, names, dates and keyboard patterns, then apply the same tricks people use to “strengthen” them.

This tester scores your password the way an attacker would approach it. It breaks the password into pieces, checks each piece against common passwords, words, sequences like abc or 321, keyboard runs like qwerty, repeats, and years or dates. Then it finds the cheapest way to guess the whole thing. The result is a realistic entropy score, an estimated crack time for five kinds of attack, and specific advice on what to fix.

Everything runs in your browser. The password isn’t uploaded, saved or logged.

Why “P@ssw0rd” and “Summer2024!” are weak

Both of these pass the usual complexity rules. They have uppercase and lowercase letters, a number and a symbol. A basic checker gives Summer2024! about 72 bits of entropy, which sounds strong. Here’s what an attacker actually sees:

A common word with a capital first letter, a recent year, and an exclamation point at the end. That is one of the most predictable structures there is, and cracking tools generate it automatically. The realistic score drops to about 21 bits, which a single graphics card can get through in a fraction of a second against a leaked hash.

P@ssw0rd is worse. Swapping letters for look-alike symbols (@ for a, 0 for o, $ for s) is so common that every cracking tool tries those swaps by default. It’s still just “password,” one of the most-used passwords in the world.

Here’s how some familiar passwords score when you account for patterns:

The gap between the two columns is the point. Raw entropy is what a password could be worth if every character were random. Realistic entropy is what it’s worth once an attacker uses what people typically do.

What is password entropy?

Password entropy measures how unpredictable a password is, in bits. Each extra bit doubles the number of guesses an attacker needs. A password with 40 bits of entropy takes about a trillion guesses to exhaust; one with 80 bits takes about a trillion times more than that.

For a truly random password, entropy is easy to calculate:

entropy = length × log2(pool size)

The pool is the set of characters that could appear. Lowercase letters give you 26, adding uppercase makes 52, adding digits makes 62, and adding the 33 standard symbols makes 95. So a random 12-character password using all four types has about 12 × 6.57 = 79 bits of entropy.

That formula only holds if the characters were picked at random, by a password manager or generator, for example. Once a person chooses the password, words and habits creep in, and the real number falls. That’s why this tool shows both values.

How long would it take to crack my password?

It depends less on the password than you might think and more on how the attacker gets to try it.

Online attacks happen through a real login page. Most sites limit failed attempts, so an attacker might manage a hundred guesses an hour. Even a weak password can hold up for a while here, unless it’s on a common-password list, in which case it falls in the first few tries.

Offline attacks are the real danger. When a site is breached, attackers often get a database of password hashes they can test on their own hardware, with no limits. How fast they go depends on how the site stored your password:

• A slow, modern hash like bcrypt holds an attacker to thousands of guesses per second.
• A fast, outdated hash like MD5 or SHA-1 allows around a hundred billion guesses per second on one modern graphics card, and far more on a cluster.

To put numbers on it: a random 8-character password has about 53 bits of entropy. Against a fast hash on one GPU, that’s cracked in around 9 or 10 hours on average. The same password stored with bcrypt would take more than 10,000 years. A random 12-character password against the fast hash would take more than 80,000 years.

You don’t control how a website stores your password, so pick one that survives the worst case. The crack-time table in the tester shows all five scenarios, with the offline GPU figure in the summary because that’s the one that matters most.

How to make a strong password

Current guidance from NIST (Special Publication 800-63B, revision 4, finalized in 2025) moved away from complexity rules. It calls for passwords of at least 15 characters when the password is the only thing protecting an account, screening against known breached passwords, and no forced changes on a schedule. In practice, that comes down to a few habits:

• Go long. Length adds more strength than any other change. Aim for 16 characters or more.
• Let a computer pick it. A password manager or the generator on this page produces truly random passwords, so the raw and realistic scores match.
• Use a passphrase if you need to remember it. Four or more random, unrelated words beat a short complex password. “Random” is the key word: song lyrics, quotes and famous examples are already in cracking lists.
• Use a different password for every account. Reuse is how one breach turns into ten. A password manager makes this painless.
• Skip the predictable tricks. Capitalizing the first letter, adding a year, ending with ! or 1, and swapping letters for symbols are the first things attackers try.
• Turn on two-factor authentication wherever it’s offered. It protects you even if a password leaks.

Need a batch of passwords or a passphrase? The Password Generator has more options. Developers storing passwords can test hashes with the Bcrypt Hash Tester.

Password Strength Tester FAQ