webutilkit

Password Strength Checker

Estimate a password’s entropy and rough crack time from the character types it uses, in your browser.

How it works

The password’s entropy in bits is estimated as its length multiplied by the log2 of the size of the character pool it appears to draw from — lowercase, uppercase, digits, and symbols each add to that pool if they appear anywhere in the password. More bits means exponentially more possible passwords an attacker would need to try.

Why “strong” here isn’t a guarantee

This assumes an attacker is trying random combinations from the detected character pool. Real attackers try common passwords, dictionary words, and predictable substitutions (like p@ssw0rd) long before brute force, so a password built from a recognizable word can score well here while still being an easy first guess.

A better strategy than memorizing rules

A long passphrase of random unrelated words is usually both stronger and easier to remember than a short password crammed with substitutions. Length is the biggest lever this calculation has, and it is also the easiest one to actually use.

Frequently asked questions

Is my password sent anywhere?

No. Everything is calculated locally in your browser and nothing is transmitted, logged, or stored — but as a rule, never type a real password you use elsewhere into any website’s strength checker.

How is the crack-time estimate calculated?

From the password’s entropy in bits (length times the log2 of the character pool it draws from), assuming an attacker can try 10 billion guesses per second — a realistic rate for an offline attack against a fast hash on modern hardware. It assumes random characters; a real cracker also tries dictionary words and known patterns first, so a "strong" score here is not a guarantee.