Password Strength Checker

Why Simple Strength Rules Fail — And What Actually Works

The classic "8+ chars, uppercase, number, symbol" rule gives a false sense of security. Here's what a real strength assessment looks at.

Password	Passes typical rules?	Actual crack time (GPU)	Why
`P@ssw0rd1!`	Yes	Under 1 second	It's in every wordlist. Pattern substitution (a→@, o→0) is hardcoded into crack tools.
`Tr0ub4dor&3`	Yes	Decades	Random words + substitution; harder than it looks, but not as good as truly random.
`correct horse battery staple`	No (no uppercase/symbol)	Hundreds of years	4 random common words = ~44 bits of entropy from an attacker guessing word combinations.
`aB3#aB3#aB3#`	Yes	Minutes	Repeating pattern. Pattern detection scores this much lower than naive length × character-set math.
`mY p@$$w0rd IS my d0g's n@me fluffy`	Yes	Years (but guessable if dog known)	Entropy is good but it's personally guessable. Targeted attacks beat random brute force.
28 random chars (a–z, A–Z, 0–9, symbols)	Yes	Heat death of the universe	~184 bits of entropy. No wordlist, no pattern.

What Goes Into a Real Entropy Estimate

Naive entropy = log2(charset size) × length. Real entropy accounts for what an attacker knows about how humans choose passwords.

Dictionary attacks are the primary threat

Offline cracking tools like Hashcat don't start with random character combinations. They start with wordlists — billions of leaked real passwords, dictionary words, names, dates, keyboard patterns — and apply mutation rules (append numbers, substitute symbols, capitalise first letter). If your password was constructed by a human without a generator, it's likely to have structure that appears in these rules.

zxcvbn — a better algorithm than rules

Dropbox's open-source zxcvbn library estimates crack time using pattern matching against real wordlists rather than character-class rules. It recognises that P@ssw0rd is weak regardless of its character mix, and that a 4-word random phrase is strong. NIST 800-63B explicitly endorses this type of approach over complexity rules.

Entropy bits explained simply

If a password has 40 bits of entropy, an attacker who knows exactly your method (e.g., "random characters from lowercase + digits") needs on average 2³⁹ ≈ 550 billion guesses to find it. At 1 trillion guesses/second (current GPU performance), that's about 9 minutes. At 60 bits, it's 36,000 years at the same rate.

Context matters: online vs offline attack

An online attack against a login form is rate-limited to maybe 10–100 guesses per second by server-side throttling. An offline attack against a leaked hash database runs at GPU speeds. A password strong enough for an online form (30 bits) is trivially cracked if the hash leaks. Design for the worst case: offline cracking.

Personal information is always guessable

Targeted attacks — against a specific person — use name, birthday, pet names, sports teams, address, alma mater. Automated tools now scrape social media to personalise their wordlists. No amount of complexity rules saves a password like London2012! when an attacker knows you're British and love football.

The checker sees the structure, not the secret

Strength checkers (including this one) never send your password anywhere. Everything runs locally in your browser. The feedback is based on pattern analysis of the password's structure — same analysis a cracking tool would do — not on checking against a specific leaked database. For breach checking, this tool uses the HaveIBeenPwned k-anonymity API which only sends a 5-character hash prefix, not the password.

Related Tools

Other free security and hashing tools on IndexCraft.

Questions About Password Security

Only if it runs locally. This tool does — all analysis runs in your browser with no network calls for the strength check itself. That said, as a general rule: be cautious about typing production passwords anywhere except their actual login page. A well-intentioned tool that gets compromised (or a phishing clone of one) would silently harvest entered passwords. If you're paranoid, test with a password of similar structure — same length, same character mix — rather than the real one.

It's the estimated time to crack the password in an offline attack, assuming the attacker knows your password generation method (worst case) and has access to a modern GPU rig running at roughly 10–100 billion guesses per second depending on the hashing algorithm used. The number is an order-of-magnitude estimate, not a precise figure. "Centuries" means practically immune to brute force; "minutes" means the password is predictable enough to appear in a wordlist or rule mutation set.

NIST 800-63B recommends a minimum of 8 characters but notes that longer is better and allows up to 64 characters. For any account you care about — email, banking, password manager master password — a minimum of 16 random characters or 6 random words. For the master password of your password manager specifically, use 20+ characters or 7+ words and memorise it. That's the one password a key logger on your system would capture.

Strength scores measure how hard a password is to guess by brute force — they don't know your password has been exposed. A password that scored "very strong" in 2015 but was stored in plain text (or badly hashed) by a service that was breached is now worthless regardless of its theoretical strength. The HaveIBeenPwned check in this tool addresses this by checking the actual password against a database of over 800 million real compromised passwords. A strong password that appears in that database should be changed immediately.

🔒 Password Strength Checker

Password Security Guide

What is Entropy?

Crack Time Explained

Passphrases

Best Practices