Check password entropy, estimate crack time, and securely test if leaked in historical breaches.
Check password entropy, estimate crack time, and securely test if leaked in historical breaches. Use it for everyday work, development, learning, or quick verification.
This tool runs in your browser. Before working with sensitive data, make sure you trust your browser and device environment.
This password strength checker scores your password live against five rules: at least 8 characters, an uppercase letter, a lowercase letter, a number and a symbol. Reaching 12 characters earns a bonus, and anything 16 characters or longer is rated full strength, because length matters more than any other single factor.
The entropy figure (in bits) is estimated as length × log2(pool size), where lowercase adds 26 possible characters, uppercase another 26, digits 10 and symbols 33. Eight lowercase letters come to about 37.6 bits, eight characters using all four groups about 52.6 bits, and twelve mixed characters about 78.8 bits. The crack time assumes an attacker trying 10 billion (10^10) guesses per second against every combination: under a minute for 8 lowercase letters, roughly 8 days for 8 mixed characters, and over a million years for 12.
Keep in mind that the formula assumes every character is picked at random. Something like "Password123!" ticks every box and shows a high entropy score, yet a dictionary attack would guess it almost instantly. A random password from a password manager, or a long passphrase made of four or five unrelated words, is the reliable choice.
The breach check queries the Have I Been Pwned Pwned Passwords database using k-anonymity. Your browser computes the SHA-1 hash locally and sends only the first 5 characters; the service returns every hash suffix sharing that prefix, and the match happens on your device. Neither the password nor its full hash ever leaves the browser, and the strength analysis itself runs entirely offline.
The strength analysis runs only in your browser and sends nothing. When you click the breach check, only the first 5 characters of the SHA-1 hash are sent, which cannot be reversed into your password. If you are still unsure, test a password with a similar structure instead.
The tool takes the pool size raised to the password length as the number of combinations and divides it by 10 billion guesses per second. That is a brute-force upper bound; real attackers try dictionaries and common patterns first, so predictable passwords usually fall much faster.
It means the password appears in publicly leaked data, and attackers try those lists first. Whatever its strength score, change it everywhere you use it right away and turn on two-factor authentication.
Aim for at least 12 characters mixing all four character types for everyday accounts, and 16 or more for important ones, with a different password for every site. Letting a password manager generate and store random passwords is far more practical than memorizing complex rules.
Browse this category: Security & Crypt
Generate strong passwords and check crack time offline.
Calculate MD5, SHA-1, SHA-256, and SHA-512 hashes for texts and local files instantly.
Scrub metadata from images (EXIF/GPS) and office documents (PDF/Word) 100% locally in your browser to protect privacy.
Validate Taiwan National ID numbers (身分證) and Alien Resident Certificates (ARC / 居留證). 100% client-side privacy-first validation with zero tracking or uploads.
