JSON Formatter
Pretty-print, validate and minify JSON with precise error positions.
Developer & Security
Password Strength Checker
Entropy, pattern detection and a realistic crack-time estimate.
What it does. Password strength is measured in bits of entropy — how many guesses an attacker needs on average. A strength meter that only counts character types is misleading: <code>P@ssw0rd1</code> satisfies every complexity rule and is among the first thousand guesses any real cracker makes. This tool scores the patterns attackers actually exploit.
Runs in your browserNothing uploadsNo signupWorks offline
How to use Password Strength Checker
- Type or paste a password. It is analysed locally and never transmitted.
- Read the entropy estimate and the patterns detected.
- Check the crack-time figures for offline attack speeds.
Why complexity rules fail
The familiar rule — one uppercase, one number, one symbol — measures whether a password looks random to a form validator, not whether it resists guessing.
People satisfy it predictably: capitalise the first letter, put the number and symbol at the end, substitute 3 for e and @ for a. Cracking tools have encoded those exact transformations for two decades, so the rule adds far less entropy than the character-set arithmetic suggests.
NIST withdrew composition rules in SP 800-63B for precisely this reason, and also withdrew mandatory periodic rotation — forced expiry pushes people toward predictable increments like Spring2026! becoming Summer2026!.
What actually helps
- Length. Every extra character multiplies the search space. It beats every other factor.
- Unpredictability. Four genuinely random words are far stronger than one mangled word.
- Uniqueness per site. Reuse means one breach compromises everything, whatever the strength.
- A password manager, which makes long random unique passwords practical.
- Two-factor authentication, which survives the password being wrong about all of the above.
What the crack times assume
Estimates here model an offline attack: the attacker has stolen a password database and is guessing against the hashes at full hardware speed.
That is the scenario worth planning for, because it is the fastest. Online guessing against a login form is thousands of times slower and usually rate-limited.
The speed also depends entirely on the hashing algorithm the site used, which you cannot control or know. Against unsalted MD5 a consumer GPU manages tens of billions of guesses per second; against bcrypt at a sensible cost factor, a few thousand. The figures shown assume a fast hash, which is the pessimistic and therefore useful case.
Frequently asked questions
Is my password sent anywhere?
No. The analysis runs entirely in your browser — there is no network request. You can verify by opening developer tools, or by disconnecting and using the page offline.
What is a good entropy figure?
Below 40 bits is weak, 60 is reasonable for a low-value account, 80 or more is strong. A password manager generating 16 random characters produces well over 100.
Why is P@ssw0rd rated so badly?
Because it is a dictionary word with the substitutions every cracking tool tries first. Complexity rules score it well; an actual attacker reaches it in the first few thousand guesses.
Are four random words really strong?
Yes, if the words are chosen randomly from a large list rather than by you. Four words from a 7,776-word list gives about 51 bits; six gives 77. Choosing words yourself collapses this, because human choice is not random.
Should I change my passwords regularly?
Not on a schedule. NIST withdrew that guidance because forced rotation produces predictable increments. Change a password when there is a reason to think it was exposed.