🔐 Password Strength Calculator
Pick a length and the character sets you'd use, and see the estimated entropy, a weak-to-strong rating, and how long an offline attacker would take to crack it. Nothing you type leaves your browser.
🛡️ Entropy & Crack Time, Estimated
What is a Password Strength Calculator?
It turns a password's length and character variety into an entropy figure in bits, then projects how long a fast offline attacker would need to brute-force it. The result is a quick, intuitive sense of whether a password policy or a single password is actually robust.
Use it to set sensible length and complexity rules, or to make the case for a password manager. The numbers are estimates for planning — real strength also depends on whether the password is predictable or already leaked, so verify your approach against your own security policies.
❓ Frequently Asked Questions
How is password strength measured?
This tool estimates entropy — a measure of unpredictability in bits. It multiplies the password length by the log base 2 of the character pool size (lowercase adds 26, uppercase 26, digits 10, symbols 32). More length and a larger pool both raise entropy, and higher entropy means exponentially more guesses to crack.
What does the crack time mean?
It models an offline attacker who has stolen a password hash and can try about ten billion guesses per second on fast hardware. The figure is the average time to find your password by brute force at that rate. It is illustrative and rounded down, not a guarantee: a slow hash such as bcrypt or Argon2, or a login that locks after a few tries, is far slower, and a bigger rig is faster. It is only shown for passwords a generator picked at random.
Why does my real password feel weaker than the rating?
Entropy assumes a truly random password. If yours is a dictionary word, a known leaked string, a name with a year, or a keyboard pattern, an attacker uses smarter guessing than brute force and cracks it far faster than the entropy suggests. That is why this tool reads "Treat as weak" for any password a person made up: "Password1!" uses all four character sets and still falls in seconds. Use unique, randomly generated passwords.
How long should a strong password be?
NIST SP 800-63B (2025) asks services to require at least 15 characters when a password is the only sign-in factor (8 when it is paired with multi-factor sign-in), to drop composition rules, and to check new passwords against a list of common and breached ones. Length does the work: 16 random characters from letters and digits rate Strong here. A password manager makes that practical, one unique password per account, and multi-factor sign-in covers the day a password leaks anyway.