Password Strength Checker

Analyses a password's entropy in bits and estimates crack time at a trillion guesses a second — a realistic figure for modern GPU-based cracking — with specific, actionable feedback rather than a vague strength meter. Nothing is sent anywhere; it all runs locally.

How entropy is actually calculated

Entropy = log₂(charset size) × length. The character set you draw from matters a lot:

• Digits only — charset of 10, ~3.32 bits per character
• Lowercase only — charset of 26, ~4.70 bits per character
• Alphanumeric — charset of 62, ~5.95 bits per character
• Full printable ASCII — charset of 94, ~6.55 bits per character

A 16-character password using the full range lands around 104 bits — computationally out of reach even for a well-resourced attacker.

Crack times that put the numbers in perspective

• A current-generation consumer GPU can run through roughly 164 billion MD5 hashes per second on its own
• A dedicated cracking cluster can exceed a trillion guesses per second
• An 8-character password, even mixing every character type, can fall in under an hour against that kind of hardware
• 12 characters pushes that out to roughly 34,000 years at the same rate
• 16 characters exceeds the age of the universe — at which point the specific number stops being meaningful and just means "not happening"

Length beats complexity, and NIST agrees

A 20-character password using only lowercase letters carries more entropy than a 10-character password using every character type available — length dominates the entropy calculation far more than most password policies assume. NIST's current guidance (SP 800-63B) reflects exactly this: prioritise length, drop the mandatory-complexity rules that push people toward predictable substitutions like @ for a, and only force a password change when there's actual evidence of compromise rather than on an arbitrary calendar schedule.