🔑 Password Strength & Crack Time
Type a password below (nothing is stored or sent anywhere). Watch its estimated entropy and how long it would take to crack, under a few different real-world attack scenarios.
This runs entirely in your browser with simple math — it is not a real password
cracker and does not check your password against any online database.
Strength: —
Length: 0
Character set size: 0
Entropy: 0 bits
Estimated time to crack
| Attack scenario | Guess rate | Estimated time |
|---|
How to read this
- Entropy measures unpredictability in bits. Each extra bit doubles the number of guesses an attacker needs to try.
- Length beats complexity. A longer password with a smaller character set (like a random passphrase) is often stronger than a short, complicated-looking one.
- Online vs. offline attacks: a login form can rate-limit or lock out guesses. Offline attacks (e.g. after a database breach exposes password hashes) have no such limit — attackers can guess as fast as their hardware allows.
- Hash speed matters. Sites that store passwords with a slow, purpose-built hash (like bcrypt or Argon2) make offline cracking dramatically slower than sites using a fast general-purpose hash (like plain MD5 or SHA-1).
Building stronger passwords
- Use a passphrase of 4–6 random, unrelated words rather than a single word with substitutions (“P@ssw0rd!” is not as strong as it looks).
- Use a unique password for every site — a password manager makes this practical.
- Turn on multi-factor authentication wherever it’s offered.