Password Strength Checker

Type "Password1!" into most of the strength meters bundled into signup forms, and you'll likely see "Strong." It has an uppercase letter, a number, and a symbol — every box a simple regex check looks for. It's also one of the first guesses a real attacker's cracking tool would try, because it's a well-known pattern, not because it's mathematically strong. This is the core flaw with checkbox-style strength meters: they measure the presence of character types, not how unpredictable the password actually is.

This tool measures unpredictability directly. It starts with entropy — the number of bits of randomness in the password, calculated from the size of the character pool actually used (lowercase, uppercase, numbers, symbols) and the password's length. Then it actively looks for the shortcuts that let real cracking tools skip most of that theoretical search space: exact matches against a list of the most commonly used passwords in the world, sequential runs like "abcd" or "4321", keyboard walks like "qwerty" or "asdf", three-or-more repeated characters, and common leetspeak substitutions like "p@ssw0rd" checked against the same common-password list after normalizing the substitutions back to letters. Each pattern found reduces the effective entropy score and shows up as a specific, named issue — not just a lower number.

The crack-time table translates that entropy into something concrete: how long would it actually take to guess this password under three realistic attack scenarios — an online login throttled to about 100 guesses a second, an offline attack against a properly slow password hash like bcrypt at roughly 10,000 guesses a second, and an offline attack against a fast, poorly-chosen hash running on GPU hardware at roughly 10 billion guesses a second. The gap between those three numbers, often many orders of magnitude, is exactly why how a service stores your password matters as much as how you choose it — but it's also not something you control, which is why choosing a genuinely high-entropy password in the first place is the one lever you always have.

One feature goes further than entropy math alone can: an optional check against Have I Been Pwned's database of passwords exposed in real data breaches, using the k-anonymity method. Your password is hashed in your browser using SHA-1, and only the first five characters of that hash are sent to the API — never your actual password, and never the rest of the hash. This is the same technique privacy-conscious password managers use, and it's the only feature on this entire site that touches the network; it's off unless you explicitly click the button, and everything else stays fully local.