Password Strength Checker & Crack-Time Analyzer
Test any password or passphrase against modern brute-force algorithms. We evaluate mathematical entropy, character variety, sequential patterns, and check for matches against known breached databases — completely client-side.
All computations run strictly inside your browser's local sandbox memory using the Web Cryptography API. We never store, log, or transmit your passwords.
Estimated Time to Crack by Attack Scenario
Web login with rate-limits (100 guesses/sec).
Unthrottled API endpoint (10,000 guesses/sec).
Dedicated 8x RTX 4090 cluster (100B hashes/sec).
Enterprise/State farm (100 Trillion/sec).
Character Composition & Pool
Vulnerability Audit & Advice
- Type a password to test its strength and calculate brute-force resistance.
How Password Strength is Mathematically Calculated
Password strength is not a subjective feeling—it is defined by information theory. The foundational metric is Shannon Information Entropy, expressed in bits:
When you type a password, we determine the available character pool $R$ (e.g., lowercase only = 26, alphanumeric = 62, full printable ASCII = 95) and multiply by the length $L$.
Understanding the 4 Attack Benchmarks
Standard web application login portals with IP throttling, CAPTCHAs, or temporary account locks. Attackers are severely constrained by network round-trips.
Mobile API endpoints or legacy authentication endpoints that mistakenly omitted rate-limiting middleware, allowing high-concurrency botnet spraying.
The most realistic scenario after a database breach dump. An attacker using an 8x RTX 4090 rig runs Hashcat against unsalted or fast hashes (MD5, SHA-1, NTLM).
Industrial datacenter-scale compute grids with dedicated FPGA/ASIC hardware clusters operated by nation-state cyber intelligence agencies.
- Length is paramount: A 16-character phrase with simple characters consistently outperforms an 8-character string filled with awkward symbols.
- Eliminate periodic forced resets: Forcing users to change passwords every 90 days actually reduces entropy by encouraging minor predictable changes (e.g.
Spring2025!toSummer2025!). - Screen against breached password lists: Over 80% of successful breaches leverage credentials that were previously leaked on public forums.