Password Strength Analyser

Worked example (simple)

Suppose your password is "123". The analyser sees a digit-only character set, so$N = 10$ and $L = 3$. Entropy is:

The score is normalized against $128\ \text{bits}$:$\text{Score} \approx 100\cdot H/128$. That’s why a very short numeric password lands in single digits.

Worked example (stronger)

Take "CorrectHorseBatteryStaple" (letters only). The analyser uses$N = 52$ (lowercase + uppercase) and length $L = 25$. The entropy becomes:

That pushes the score to the cap (100/100). In real-world security, long passphrases are often easier to remember than short “complex” strings.

Practical checklist

• Prefer length first: add characters before adding complexity rules.
• Avoid patterns (keyboard walks, dates, names) even if they look “mixed”.
• Use unique passwords per site; reuse makes the weakest site the single point of failure.
• For high-value accounts, pair a strong password with 2FA and recovery codes.

Working on storage and hashing? Use Bcrypt to understand the difference between a strong password and a properly hashed password.

1) Character set size

The analyser detects which character categories appear in your password and builds a character set size$N$. A simple model is:

This is an approximation, but it’s a solid way to compare “digits-only” vs. “mixed characters”.

2) Entropy

Entropy estimates how much uncertainty your password has under the brute-force model:

Where $L$ is length and $N$ is the character set size.

3) Crack time

For brute force, the number of possibilities is $N^L$. On average, an attacker needs about half of them:

With an assumed guess rate $r$ (guesses per second), the expected time is:

4) Score

The score maps entropy to a 0–100 scale using a 128-bit “excellent” reference point:

Entropy vs. real-world attacks

Entropy is useful for comparing choices, but it does not cover everything. Real attackers often use dictionary attacks, leaked password lists, and pattern-based guessing. That means a “clever-looking” password can crack quickly if it is based on common words.

Online vs. offline guessing

Online systems can rate-limit attempts, while offline attacks (stolen password hashes) can be much faster. The best defense is a combination of strong passwords and strong hashing (e.g., bcrypt with appropriate cost).

To explore hashing behavior, see Hash Text and Bcrypt.

Does this tool upload my password?

No. The calculation runs locally in your browser. Avoid sharing real passwords in screenshots or URLs.

Why can a long passphrase be stronger than a short complex password?

Because entropy scales with length: $H = L\,\log_2(N)$. Increasing $L$ is a reliable multiplier.

Is the crack time accurate?

It is an estimate under a simple brute-force model. Real crack times can be faster (dictionary attacks) or slower (rate limits).

What score should I aim for?

For important accounts, aim for a score that implies high entropy (ideally approaching the 100/100 cap). For low-risk logins, lower can be acceptable if you use 2FA and uniqueness.

Does adding symbols always help?

It can increase N, but adding length often gives a bigger and more predictable gain.

What if my password includes non-ASCII characters?

This analyser uses a simplified character set model. Non-ASCII characters may not be represented perfectly in the charset size.

• Brute-force estimates do not model dictionary attacks or leaked-password checking.
• Assumed guess rates vary wildly based on hashing algorithms, hardware, and rate limiting.
• A strong password still needs safe storage (hashing + salting) on the server side.
• This does not replace professional security review for high-risk systems.

• NIST Digital Identity Guidelines (SP 800-63B)

  External reading to deepen your understanding.

• OWASP Authentication Cheat Sheet

  External reading to deepen your understanding.

• Have I Been Pwned? (checking leaked passwords)

  External reading to deepen your understanding.