Password Strength Checker
Evaluate password strength, brute-force crack times, and data breach leaks — 100% private in your browser.
Password Input
🔒 100% In-BrowserCheck against 900M+ leaked accounts from public database breaches.
Crack Time & Diagnostics
Requirements Checklist
- At least 12 characters (16+ recommended)
- Contains lowercase letters (a-z)
- Contains uppercase letters (A-Z)
- Contains numbers (0-9)
- Contains special symbols (!@#$%^&*)
Security Scan
Type a password above to scan for patterns and vulnerabilities.
How Password Strength & Crack Times Work
Password security depends directly on mathematical entropy — the total number of possibilities an attacker must search. Longer passwords expand the search space exponentially ($N^L$), making them far more resilient than short passwords stuffed with complex symbols.
Frequently asked questions
Is it safe to type my password into this tool?
Yes. All entropy calculations, pattern detection, and crack time simulations run 100% locally in your browser via client-side JavaScript. No password or keystroke is ever sent to our servers, logged, or stored.
How does the data breach check protect my privacy?
The breach check uses mathematical k-Anonymity. Your browser computes the SHA-1 hash locally and sends only the first 5 hexadecimal characters to Have I Been Pwned. The API returns matching hashes, and your browser verifies whether your password is among them in memory. Your password never leaves your device.
How are the brute-force crack times calculated?
Crack times are based on Shannon entropy (E = L × log2(N)). We divide the total search space by estimated guess speeds across realistic scenarios: from a rate-limited web login (100 guesses/sec) to an 8x RTX 4090 GPU cluster (100 billion guesses/sec).
Why does password length matter more than complexity?
Length expands the search space exponentially (N^L). Adding four extra characters multiplies search combinations by millions, providing vastly more protection than swapping a few letters for symbols in a short password.
What is the difference between a password and a passphrase?
A password is typically a single string of mixed characters, whereas a passphrase consists of multiple random dictionary words (e.g., "correct-horse-battery-staple"). Passphrases are easier to remember and provide astronomical entropy.
Why is Two-Factor Authentication (2FA) still necessary?
Even the strongest password cannot protect you if a service suffers a server-side database breach or if you encounter a phishing site. 2FA prevents attackers from logging in even if they possess your exact password.