Password Strength — what it does
Scores a password the way an attacker's scripts weight it: entropy in bits, realistic crack-time across attack scenarios, dictionary matches and pattern penalties. Crucially, it computes everything in your browser — the password is never transmitted, which is the whole point of checking a password before you commit to it.
How to use Password Strength
- Type the password in the field — it stays local; there is no network call.
- Read the entropy (bits) and the crack-time estimate under three attack models: online throttled, offline bcrypt-class and offline fast-hash.
- Check the pattern warnings: dictionary words, keyboard runs, repeats, sequences and common substitutions.
- Improve per the advice: length first, then unpredictability — a long passphrase beats a short symbol-soup.
- Re-check until the offline-attack estimate is comfortably beyond any realistic effort, then use a manager to keep it.
Worked example: "Summer2024!" vs a 4-word passphrase
Score them both: the former shows dictionary hits ("summer", "2024") and an entropy near 40 bits — offline-crackable in hours. A four-word passphrase shows 70+ bits and centuries under the same model. Same keyboard effort, different leagues of resistance.
At a glance
| Input | The candidate password (stays on-device) |
|---|---|
| Output | Entropy bits, crack-time across 3 attack models, pattern findings |
| Model | Dictionary + pattern analysis, not just length |
| Where it runs | Entirely in your browser — no submission, ever |
| Offline | Yes |
Frequently asked questions
- What is Password Strength?
- Score password strength with entropy and crack-time estimates.
- Is Password Strength free to use?
- Yes — Password Strength is free to use, with no sign-up, no install and no account.
- Does Password Strength upload or store my data?
- No — Password Strength runs entirely in your browser, so your text, files and results never leave your device.
- Do I need to install anything to use Password Strength?
- No — it works in any modern browser (Chrome, Edge, Firefox, Safari) with no downloads, accounts or plugins.
- Is the crack time estimate a promise?
- No — it is a scenario model. Real attackers use leaked-password tables and likely mutations, which the dictionary/pattern checks reflect. Treat estimates as orders of magnitude for comparison between candidates, and prefer the much-longer option every time.
- Does checking send anything anywhere?
- No. That is the non-negotiable design point: a strength checker that uploads the password would itself be the leak. This one computes with local JS and shows you it is offline (your network tab will confirm).
- Why does my 12-character password score low?
- Because entropy is about unpredictability, not just length: a real word plus year is two guesses away from a cracking rule. Length helps hugely when each added character is unpredictable — that is why passphrases win.