Password Strength & Entropy Checker

Inspect raw vs effective entropy, character pool coverage, pattern penalties, and explicit online/offline crack-time estimates -- 100% in your browser.

Private by architecture: All processing is 100% client-side memory. Your data never leaves this browser tab.

Password or passphrase to evaluate

Show password text

Entropy & crack-time estimates

Strength rating

Very Weak

Length: 0 chars
Active pool: 0 chars
Raw entropy: 0.0 bits
Effective entropy: 0.0 bits

Estimated crack time (average 50% keyspace)

Online throttled (100/hr): -
Online unthrottled (100/s): -
Offline slow KDF (10k/s bcrypt): -
Offline fast hash (10B/s SHA-256): -

Detected patterns & suggestions

Pattern penalties

Actionable recommendations

About This Tool

Analyzes a password or passphrase locally in your browser. Calculates raw pool entropy (length * log2(poolSize)) and subtracts pattern penalties for common roots, l33t substitutions, keyboard walks (qwerty, 12345), repeated runs, and 4-digit years.

Estimates average time-to-crack across four explicit attack models: throttled online login (100/hr), unthrottled online API (100/sec), offline slow KDF like bcrypt/Argon2id (10k/sec), and offline fast raw hash like SHA-256/MD5 on a GPU rig (10B/sec).

Key Features

Raw vs effective entropy: Compares naive character-pool entropy against pattern-penalized effective entropy in bits.
Pattern & l33t detection: Flags keyboard walks, ascending/descending sequences, repeated characters, 4-digit years, and l33t-encoded dictionary roots.
Explicit crack-time assumptions: Shows side-by-side crack durations for rate-limited web logins, unthrottled APIs, bcrypt/Argon2id hashes, and raw SHA-256 GPU cracking.
Zero network transmission: 100% in-browser analysis. Your password is never sent to any server or third-party API.

Frequently Asked Questions

Why do raw entropy and effective entropy differ?

Raw entropy assumes every character was chosen independently at random from the active character classes. Human-chosen passwords often contain words ("P@ssw0rd"), keyboard walks ("qwerty"), or years ("2025") that cracking tools test first, reducing the real search space.

Why does offline fast-hash cracking take seconds when bcrypt takes years?

A modern GPU rig can evaluate ~10 billion unsalted SHA-256 or MD5 hashes per second, whereas password-hashing functions like bcrypt (cost 10+) or Argon2id intentionally consume milliseconds of CPU/RAM per guess (~10,000 guesses/sec on a GPU).

Is the password I type here sent anywhere?

Never. All scoring, regex matching, and math happen locally in your browser tab.