Password Strength Analyser
Analyze a password's entropy and see realistic crack-time estimates across five different attack scenarios, from a rate-limited login form to a GPU cluster.
Recommended Settings
Pro Tips
- •These are theoretical brute-force estimates assuming an attacker has no better strategy than trying every possible combination - in reality, dictionary attacks and known password patterns often crack weak passwords far faster
- •Length matters more than complexity for entropy - a long passphrase of random words often beats a short, complex-looking password
- •The 'offline fast hash' and 'GPU cluster' scenarios represent what happens if a password database is stolen and the passwords were hashed with a fast, non-purpose-built hash like MD5 or SHA-1
- •A password hashed properly with bcrypt or a similar slow hash is dramatically more resistant to offline cracking than the same password hashed with a fast general-purpose hash
Most Popular
Most security-conscious users aim for at least 60 bits of entropy, which resists all but the most well-resourced offline attacks for a meaningful length of time
When to Use This Tool
Get a concrete sense of how long a specific password would realistically take to crack.
Learn how dramatically attack speed varies between a rate-limited login and an offline GPU attack.
Demonstrate why password length and hash choice matter using concrete crack-time numbers.
Use entropy-based reasoning when defining a minimum password strength requirement.
How It Works
Determine which character sets (lowercase, uppercase, digits, symbols) appear in the password to estimate the total possible combination pool
Calculate entropy in bits as the password length multiplied by the log base 2 of that pool size
Divide the average number of guesses needed (half the total combinations) by different assumed attack speeds to estimate crack time under each scenario
100% Private
Files never leave your device. All processing happens locally in your browser.
Lightning Fast
Powered by Client-side entropy and brute-force time estimation for optimal performance on modern browsers.
Open Source
Built with verified, open-source libraries. Fully transparent.
Frequently Asked Questions
Why do the crack times vary so dramatically?
Attack speed depends enormously on the situation - a login form that rate-limits attempts to 100 per second is vastly slower to attack than an offline GPU cluster trying billions of guesses per second against a stolen, weakly-hashed password database.
Does this account for dictionary attacks?
No, this is a pure brute-force entropy calculation. Real attackers often try common passwords, dictionary words, and known patterns first, which can crack weak or predictable passwords much faster than these worst-case brute-force estimates suggest.
Why does password length matter so much?
Entropy grows exponentially with length - each additional character multiplies the total number of possible combinations by the size of the character pool, quickly making brute force infeasible.
Is my password sent to a server?
No. The entire analysis happens locally in your browser. Nothing you type is transmitted anywhere.
What's a good entropy target?
Many security guidelines suggest aiming for at least 60-80 bits of entropy for accounts protecting sensitive data, which resists all but the most well-resourced offline attacks for a very long time.