Password Strength Checker & Generator — Entropy & Crack Time

How to Use the Password Strength Checker

You can either audit a candidate password or generate a new one. Steps:

1. Check a password — Type into the check field. The meter and stats update live.
2. Or generate — Set length (8–64), toggle uppercase / numbers / symbols, click Generate.
3. Read the results — Entropy (bits), crack-time estimate, strength label, and character pool size.
4. Copy securely — Use Copy, then paste into a password manager — not a shared notes app.

Example: Generate length 16 with uppercase, numbers, and symbols enabled. Typical pool size is about 94 characters. Entropy ≈ 16 × log₂(94) ≈ 105 bits → labeled Very strong, with crack time in the centuries range under our brute-force model. Compare that to Summer2024! (12 characters, predictable pattern): mathematical entropy may look “fair,” but dictionary and pattern attacks break it quickly.

All analysis stays in your browser — nothing is uploaded.

What Is Password Entropy and Why It Matters

Entropy is a measure of unpredictability. In password security it is usually expressed in bits. Each extra bit doubles the number of guesses an attacker needs in a pure brute-force search. Going from 40 bits to 41 bits is not a small upgrade in relative terms — it doubles the work — which is why the strength meter jumps in bands rather than treating all “complex” passwords as equal.

Think of a coin flip as 1 bit (2 outcomes). A random character from a 94-symbol alphabet is about log₂(94) ≈ 6.55 bits. Sixteen independent random characters ≈ 105 bits. That is why length multiplies strength so effectively: going from 8 to 16 characters roughly doubles the bits if the pool stays the same (8 × 6.55 ≈ 52 bits vs 16 × 6.55 ≈ 105 bits).

Websites often require “one uppercase, one number, one symbol.” Those rules enlarge the pool slightly but do little if the password is short or based on a name and year. Attackers try common passwords, leaked lists, and keyboard patterns first — long before they brute-force a full 94¹⁶ space. A password like P@ssw0rd may look “complex” to a composition checker while remaining one of the most guessed strings in breach corpora.

Offline vs online attacks: Online login forms are often rate-limited, so even weaker passwords can survive short attacks. Offline attacks against stolen password hashes can try billions of guesses per second on GPUs — which is the scenario our crack-time model illustrates. Slow hashes (bcrypt, scrypt, Argon2) and unique salts make offline cracking much harder; unsalted fast hashes make it easier.

Use entropy as a lower bound for random passwords, then add good habits: unique passwords per site, a manager, and multi-factor authentication on email and banking. Prefer generating 16–20 character random strings for new accounts rather than recycling a memorable base with a site suffix.

Entropy Formula & Worked Crack-Time Example

Core formula used by this tool:

Entropy (bits) = length × log₂(pool)

where pool is the sum of character classes detected in the password (or selected for generation).

Worked example A — short “complex” password: Ab1!

• Length = 4, pool = 94
• Entropy = 4 × log₂(94) ≈ 26.2 bits → Weak
• Combinations = 94⁴ ≈ 78 million
• At 10¹⁰ guesses/sec, average time is effectively instant

Worked example B — random 12-character mixed password:

• Length = 12, pool = 94
• Entropy = 12 × log₂(94) ≈ 78.7 bits → Strong / near very strong
• Combinations = 94¹² ≈ 4.8 × 10²³
• Average crack time at 10¹⁰/sec ≈ 7.6 × 10⁵ years → shown as a very long time / centuries scale in the UI

Quick reference:

Crack time in the UI assumes a fixed 10 billion guesses per second and average-case half the keyspace. Slow hashes (bcrypt, Argon2) and account lockouts make real attacks much harder; unsalted MD5 dumps make them easier. Treat the label as a teaching aid, not a warranty.

Generator tip: Default length 16 with uppercase, numbers, and symbols enabled uses a large pool and typically lands in the Very strong band. If a site rejects symbols, uncheck Symbols and increase length to 18–20 to keep entropy high with a smaller pool (letters + digits ≈ 62 → log₂(62) ≈ 5.95 bits per character; 20 × 5.95 ≈ 119 bits).

Important Limitations & Common Mistakes

Do not rely on entropy alone:

• Dictionary words: High character variety does not save memorable phrases if those exact words are common — our formula does not score wordlists or keyboard walks like qwerty123.
• Reuse: A 105-bit password reused on a breached site is still compromised everywhere you reused it.
• Writing passwords in chat or email: Treat generated strings as secrets immediately; clear clipboard history on shared machines.
• Over-trusting “instant” vs “centuries”: Numbers are pedagogical estimates, not penetration-test results.
• Modulo bias in naive generators: We use crypto.getRandomValues; avoid homemade Math.random() generators for real accounts.
• Skipping MFA: Even strong passwords benefit from a second factor on critical accounts.

For everyday digital hygiene beyond passwords, keep unique credentials in a manager and review account recovery email security — that inbox is often the real master key.

Related Tools

• Reading Time Calculator — Estimate how long articles and posts take to read
• Hashtag Generator — Build relevant hashtag sets for social posts