Back to All Security Tools

Password Strength Checker & Crack-Time Analyzer

Test any password or passphrase against modern brute-force algorithms. We evaluate mathematical entropy, character variety, sequential patterns, and check for matches against known breached databases — completely client-side.

Zero Data Transmission Guarantee100% Client-Side

All computations run strictly inside your browser's local sandbox memory using the Web Cryptography API. We never store, log, or transmit your passwords.

Works Offline
Local CSPRNG
No Server Storage
Strength Rating:Very Weak
Score: 0/100Entropy: 0 bits

Estimated Time to Crack by Attack Scenario

Online (Throttled)
Instant

Web login with rate-limits (100 guesses/sec).

Online (Fast API)
Instant

Unthrottled API endpoint (10,000 guesses/sec).

Offline GPU Rig
Instant

Dedicated 8x RTX 4090 cluster (100B hashes/sec).

Massive Supercluster
Instant

Enterprise/State farm (100 Trillion/sec).

Character Composition & Pool

Total Length0 chars
Search Pool0 characters
Lowercase (a-z)✗ None
Uppercase (A-Z)✗ None
Numbers (0-9)✗ None
Symbols (!@#$)✗ None

Vulnerability Audit & Advice

Password is empty
Cryptographic Recommendations
  • Type a password to test its strength and calculate brute-force resistance.

How Password Strength is Mathematically Calculated

Password strength is not a subjective feeling—it is defined by information theory. The foundational metric is Shannon Information Entropy, expressed in bits:

Entropy (bits) = Length × log₂(Character Pool Size)
Total Search Space = 2^(Entropy) combinations

When you type a password, we determine the available character pool $R$ (e.g., lowercase only = 26, alphanumeric = 62, full printable ASCII = 95) and multiply by the length $L$.

Understanding the 4 Attack Benchmarks

1. Online Attack (Rate-Limited: 100/sec)

Standard web application login portals with IP throttling, CAPTCHAs, or temporary account locks. Attackers are severely constrained by network round-trips.

2. Online Attack (Fast API: 10,000/sec)

Mobile API endpoints or legacy authentication endpoints that mistakenly omitted rate-limiting middleware, allowing high-concurrency botnet spraying.

3. Offline GPU Rig (100 Billion/sec)

The most realistic scenario after a database breach dump. An attacker using an 8x RTX 4090 rig runs Hashcat against unsalted or fast hashes (MD5, SHA-1, NTLM).

4. Nation-State Supercluster (100 Trillion/sec)

Industrial datacenter-scale compute grids with dedicated FPGA/ASIC hardware clusters operated by nation-state cyber intelligence agencies.

NIST SP 800-63B Authentication Recommendations
  • Length is paramount: A 16-character phrase with simple characters consistently outperforms an 8-character string filled with awkward symbols.
  • Eliminate periodic forced resets: Forcing users to change passwords every 90 days actually reduces entropy by encouraging minor predictable changes (e.g. Spring2025! to Summer2025!).
  • Screen against breached password lists: Over 80% of successful breaches leverage credentials that were previously leaked on public forums.