Password Strength Meter

How is password strength calculated?

Strength is calculated using Shannon entropy (H = length × log₂(charset size)) combined with a weighted scoring system. Points are awarded for length (up to 40), character variety (up to 30), entropy thresholds (up to 20), and length bonuses (up to 10). The final score from 0-100 maps to Very Weak, Weak, Fair, Strong, or Very Strong.

What does the time-to-crack estimate mean?

The time-to-crack estimate shows how long it would take an attacker to guess your password by trying all possible combinations (brute-force) at a rate of 1 billion guesses per second. This is a conservative estimate - an attacker with specialised hardware could be faster. The estimate uses the formula: combinations / 1,000,000,000.

Is my password sent anywhere when I check it?

No. All analysis happens locally in your browser using JavaScript. Your password never leaves your device - it is not sent to any server, not stored, not logged, and not transmitted over the network. You can verify this by disconnecting from the internet and testing that the tool still works.

How does the password generator work?

The generator uses crypto.getRandomValues(), the browser's cryptographically secure pseudo-random number generator (CSPRNG). It creates random passwords from 8 to 64 characters using your selected character sets. The randomness is suitable for password generation and other security-sensitive applications.

What is Shannon entropy?

Shannon entropy measures the unpredictability of a password in bits. Each bit represents a binary decision that an attacker must guess. Higher entropy means more combinations to try. For example, a password with 40 bits of entropy requires 2⁴⁰ (about 1 trillion) attempts to crack. General guidance: aim for 60+ bits of entropy for important accounts.

Why is length more important than complexity?

Each additional character multiplies the number of possible combinations by the size of the character set. Adding one character to a 12-character lowercase password adds 26 times more combinations. Adding complexity (e.g., adding uppercase) to a short password increases combinations by a smaller factor. A 20-character lowercase-only password is stronger than an 8-character password with all character types.

What makes a password weak?

Common weaknesses include: short length (under 8 characters), using only one character type, containing dictionary words, personal information (names, birthdates), keyboard patterns (qwerty, 12345), repeated characters (aaa, 111), and common substitutions (p@ssw0rd). The tool's checklist flags these issues automatically.

Should I use a password manager?

Yes. Password managers generate and store strong, unique passwords for each of your accounts, so you only need to remember one master password. They eliminate password reuse, make it practical to use 20+ character random passwords, and protect against phishing attacks by auto-filling credentials on the correct site.

What is the recommended password length?

Minimum: 8 characters (absolute floor, still weak). Recommended: 12-16 characters for most accounts. Strong: 16-20 characters for important accounts (email, banking, password manager master password). Maximum: 64 characters (the max length this tool supports, vastly stronger than necessary with a full character set).