Password Strength Analyzer
Check the security of your password. Our free analyzer calculates entropy and time to crack based on modern standards.
Advertisement
Advertisement
How Password Strength Is Measured
Password strength is primarily determined by entropy — a measure of unpredictability. Higher entropy means more possible combinations, which means longer cracking time. This tool estimates strength based on length, character diversity, and common patterns.
Factors That Affect Password Strength
- Length: the single most important factor — each character multiplies the search space
- Character set: lowercase (26) → +uppercase (52) → +numbers (62) → +symbols (94 possible characters)
- Randomness: "Abc123!" has patterns — "k#9mP!zQ" with similar chars is far stronger
- Dictionary words: "password", "qwerty", "123456" appear in every cracker's first-pass list
Crack Time Estimates
- Modern GPUs can test 10–100 billion hashes/second against leaked hash databases
- 8-char lowercase password: crackable in seconds
- 12-char mixed case + numbers: hours to days
- 16-char with symbols: years to centuries
- 20+ char truly random: effectively uncrackable
Is it safe to type my real password into a strength checker?
This tool runs entirely in your browser — your password is never sent anywhere. As a general security practice, avoid entering real passwords into third-party websites. Use this tool to test patterns and understand what makes passwords strong, rather than testing your actual live passwords.
What is zxcvbn and how does it estimate crack time?
zxcvbn (Dropbox's password strength library) is the most widely used realistic strength estimator. Unlike simple checkers that count character types, zxcvbn pattern-matches against dictionaries of common words, keyboard patterns (qwerty, 1234), dates, and common substitutions. It gives a 0–4 score and an estimated crack time based on dictionary attacks, not just brute-force math.