Password Strength Calculator

How it is calculated

The engine starts from length and the kinds of characters used. The pool is the sum of the sets present: lowercase letters add 26, uppercase 26, digits 10, and any other character (symbols, spaces, accented letters) adds 33. Then entropy (bits) = length × log₂(pool size). Two discounts follow. A password made of one short unit repeated (aaaa, abab) is only credited with the entropy of that unit. A well-known word such as password, qwerty or admin, even with digits or symbols added at the end, and plain number runs like 123456, is capped at 20 bits. Crack time is 2entropy ÷ 10¹⁰ seconds, assuming 10 billion guesses per second, shown in seconds, minutes, hours, days or years, and shown as "> 1,000,000,000,000,000 years" beyond that. The rating is Weak below 40 bits, Moderate from 40 to 60, Good from 60 to 80 and Strong from 80. An empty field gives no result. The tool has no leaked-password list, so a predictable password outside its short built-in list can still score higher than it deserves.

Common mistakes

• Typing a password you actually use. The text you enter is submitted for calculation, so test a similar-looking pattern, not the real thing.
• Trusting a high score for a predictable choice. A name or phrase with a capital letter, a digit and a symbol, such as Tr0ub4dor&3, scores 72.3 bits and Good, although attackers try such patterns early. Only a short list of very common words is discounted.
• Expecting a long repeated string to look strong. Twenty letter a characters score only 4.7 bits, because a repeated unit carries the entropy of the unit.
• Reading "< 1 sec" or "9 min" as a bad calculation. Short passwords really do fall in that time under the 10 billion guesses per second assumption; a nine-letter lowercase password shows 9 min.
• Reading the crack time as a guarantee. It assumes one fixed guess rate against one password; real attacks depend on how the password is stored and are far faster or slower.