Password strength checker
Enter a test string to see its entropy, character types, pattern warnings and educational crack times for PC, GPU, supercomputer and quantum models.
entropy · crack time · patterns
Live password strength analysis
The strength bar, character analysis, pattern warnings and 4 modeled crack times update as you type.
🎮 Explore with test examples. Do not enter real account passwords, password fragments or recovery codes. The analysis input is not uploaded or stored.
Enter a test password.How to use the password strength checker
Explore a live strength bar, entropy value, character tags, pattern warnings and crack-time comparisons across four computing models. Results update immediately as the test string changes. Warnings flag common demo passwords, repeated characters, sequential digits and keyboard patterns. Analysis runs in the current browser memory; the input is neither uploaded to a server nor saved.
Avoid entering real passwords, fragments, recovery codes or OTPs into a checker page. Use publicly known test strings or examples unrelated to any real account. Entropy and crack times are educational estimates based on length and character pool. They do not check breaches, password reuse, phishing, the service's stored password hash or login rate limits.
When this tool is needed
- Compare how string length and character types affect entropy
- Explore warnings for common passwords, repeats, digit sequences and keyboard patterns
- Compare the PC, GPU, supercomputer and quantum models for learning
Check before entering
- Use a known test string or an example unrelated to real account passwords.
- Times are educational estimates assuming uniformly random characters and a fast hash.
- If you suspect a breach, change the password through the official service and enable MFA instead of testing it here.
How to use
- Enter a test string unrelated to any real account.
- Use the eye button to show or hide the test string.
- Read the strength bar, rating, entropy and active character tags.
- Compare the pattern warnings and educational times for the four computing models.
- Read the verdict, then use Clear to reset both the input and results.
Real account habits matter more than an entropy score
Even a long, complex-looking password can expose several accounts when reused across services. Generate and store a unique value for each account with a password manager, and use the service's blocklist checks together with MFA or passkeys. This page's common-password list and pattern checks are a small demonstration. They do not replace breach checks or a service's larger blocklist.
NIST length guidance and composition rules
NIST SP 800-63B-4 requires at least 15 characters for passwords used as a single authentication factor and recommends allowing at least 64 characters. It says not to impose character-composition rules or arbitrary periodic changes, and calls for checking common, expected or compromised values against a blocklist. The character tags here describe the model; they do not require every password to mix uppercase letters, digits and symbols.
Character length and non-ASCII limitations
This demo uses JavaScript UTF-16 length, so an emoji can count as 2 or more characters. The simplified pool adds 26 ASCII lowercase letters, 26 uppercase letters, 10 digits and 33 other characters when each group is detected. Accented letters, Korean characters and emoji fall into that last group; this does not model the full Unicode space. NIST counts Unicode code points instead, so do not use this score to decide whether a service's length requirement is met.
Limits of the crack-time numbers
The time estimate assumes every possible string of the chosen length is equally likely. Human-created phrases rarely meet that assumption because of words, dates and keyboard patterns. Attackers may try leaked-password dictionaries and guessing rules before exhaustive search. Slow password hashes, salts, login rate limits, account locks and MFA also change the cost of a real attack. A result measured in years or ages of the universe is therefore no guarantee of security.
This tool supports local exploration and security education. It does not audit a service, search breaches, check a production blocklist or simulate a real attack. Do not enter current passwords. Change them and configure MFA through a password manager and the official account settings.
Calculation basis and sources
- Calculation scope
- Analyzes test-string entropy, character groups, patterns and educational crack times for four computing models.
- Calculation method
- Uses string length and the detected character pool to model entropy and exhaustive offline guessing, alongside NIST guidance on 15-character minimums, blocklists, unique values, managers and MFA.
- Limits and disclaimer
- Crack times and color ratings assume a uniformly random character pool and a fast hash. They are educational, not a guarantee of account security. Do not enter real passwords.
- Personal information processing
- Test strings are analyzed only in the current browser memory and are not uploaded or stored.
🗓️ Source and wording reviewed 2026-09-02 · 🔁 Next review 2027-03-01
FAQ
What is entropy in bits?
Entropy is an educational measure expressing the number of possible combinations in bits, based on length and the character pool. It does not adequately account for human words, dates, reuse or breaches, so entropy alone cannot establish a real account's security.
Are the displayed times real attack times?
No. This simple model assumes uniformly random characters and exhaustive offline guessing against a fast hash. Dictionary attacks, reused leaked passwords, phishing, service rate limits, the actual stored hash and MFA can change the outcome substantially.
Should I enter a password I currently use?
We advise against it. Analysis runs locally in the current browser without uploading or saving the input, but real authentication secrets should stay out of checker pages. Explore with publicly known test strings or examples unrelated to any new password.
How long should a password be under NIST guidance?
NIST SP 800-63B-4 requires at least 15 characters when a password is the sole authentication factor. A password used only as part of MFA may have a minimum of 8 characters. The guidance prioritizes sufficient length, blocklist checks and unique passwords over mandatory character mixtures.
Should I use both a password manager and MFA?
Yes. A manager helps generate and store a long, unique value for each account, while MFA or passkeys add protection if a password is exposed. Consider phishing-resistant passkeys or security keys when available.