Password Strength Analyzer & Crack Time — Free
Runs 100% in your browser — your files never leave your device.
How long would your password actually hold up? This analyzer computes its entropy and character-set size, then estimates crack time assuming a billion guesses per second — offline GPU speed. Scores are capped at 128 bits, and because the check runs locally, the password you test is never transmitted.
How it works
- 1
Type a password
The analysis updates live as you type.
- 2
Read the entropy score
See charset size, entropy in bits, and a 0–1 strength score.
- 3
Check the crack-time estimate
A human-readable estimate shows how long the password would resist.
About this tool
What the analyser measures
The analyser estimates how hard your password is to guess: length, character variety, and — the part most checkers miss — whether it matches known patterns. "P@ssw0rd1" ticks every complexity box and still falls in seconds, because attackers guess patterns, not just character counts.
Length beats complexity
The math favors length overwhelmingly: a 16-character random lowercase string out-guesses an 8-character string with every symbol class. The best passwords are long and random — a password generator output, or a four-word passphrase — rather than short strings decorated with substitutions.
Everything computes locally
Testing a password here sends it nowhere — the analysis runs in your browser. That matters: pasting a real password into a service that logs input would be the exact mistake the analyser is trying to prevent.
Frequently asked questions
Why does the tool dislike my complex password?
Substitutions like @ for a and 1 for i are the first patterns every cracking tool tries. Complexity rules that encourage them produce passwords that look strong to humans and fall fast to machines.
What makes a password actually strong?
Length and randomness above all: 16+ truly random characters, or a passphrase of four or more unrelated words. Pattern-free beats pattern-decorated every time.
Does the analyser store or transmit my password?
No — analysis runs entirely in your browser, and the input is never sent, stored, or logged anywhere.