Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.
Type the password you want to evaluate for strength.
See the strength score from weak to very strong.
Follow the suggestions to improve your password security.
This tool scores a password you type into the field, estimating its entropy in bits from the character types used (lowercase, uppercase, digits, symbols) and length, then converts that into an estimated brute-force crack time plus a list of specific weaknesses such as short length, low character variety, or repeated and sequential runs. Everything runs locally in your browser, so the password is never transmitted or logged. What people most often misread is the crack-time figure: it reflects one assumed attack speed and hashing scenario, so a password rated centuries to crack under one assumption can fall to hours under a faster offline attack, and a good score is not a guarantee against someone guessing a personally meaningful phrase.
Entropy in bits is estimated from the size of the character pool the password draws from (lowercase, uppercase, digits, symbols) combined with its length, then reduced for detectable predictability such as repeated characters, simple sequences like abc or 123, or keyboard-adjacent runs like qwerty. A higher bit count means more possible combinations an attacker has to search through before landing on a match.
The entropy value is converted into a human-readable time-to-crack figure by dividing the total possible combinations by an assumed guesses-per-second rate, usually shown across more than one attack scenario, such as slow throttled online guessing versus a fast offline hash-cracking attempt. Because the guess rate is an assumption rather than a measurement of any specific site's actual defenses, treat the figure as an order-of-magnitude guide, not a precise prediction.
No. The analysis runs locally on the page; nothing is sent to a server, logged, or stored once you navigate away. That's what makes it reasonable to test a real password you're considering rather than a stand-in.
Different tools assume different guess rates and attack scenarios, such as online versus offline, or salted versus unsalted hashing, so the same entropy score can produce very different time-to-crack numbers. Use the figure to compare passwords against each other, not as an absolute guarantee.
The behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Generate strong, random passwords with customizable length, character sets, and complexity requirements.
Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.
Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.
Scan and decode QR codes from uploaded images or your device camera to extract embedded data.
Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.
Encrypt and decrypt text using AES-256, RSA, or other ciphers with password-based key derivation.