Is this the same kind of strength check as zxcvbn?

No, it's a simpler character-set entropy model (length times log2 of pool size), so it won't catch things like common dictionary words or keyboard patterns the way a pattern-aware analyzer such as zxcvbn does.

Does the password I type get sent anywhere?

No, the entropy calculation and warnings are computed with plain JavaScript running in your browser tab, so the password you analyze is never transmitted or stored.

What does the crack time estimate actually assume?

It assumes an attacker running 10 billion guesses per second offline against a fast, unsalted hash and averages to about half the keyspace; a slow, salted hash like bcrypt makes real-world cracking far slower than this figure suggests.

Why did a long password still score as weak here?

If it only uses one character class, for example digits only or a single repeated character, the pool size used in the entropy formula stays small, so length alone doesn't raise the score much.

Password Strength Analyser

Estimate a password's entropy and crack time from its character sets, locally.

Local, Runs entirely in your browser, your data never leaves your device.

Loading tool…

Estimate entropy and crack time from character sets

This tool scores a password by looking at which character classes it uses (lowercase, uppercase, digits, spaces, symbols), building a character pool size from that, and computing entropy as length times log2(pool size). From that it estimates how long an offline attacker guessing at 10 billion attempts per second would take to crack it, plus specific warnings like no digits or too short. It's a transparent heuristic, not a dictionary-aware analyzer, and the password never leaves your browser.

How to use the Password Strength Analyser

Type a password into the input field.
Read the strength label, from Very weak to Very strong, and the entropy in bits.
Check the estimated crack time under an offline, fast-hash attack scenario.
Review the listed warnings, such as missing character classes or repeated characters.

This is character-set entropy, not a dictionary or pattern-aware model like zxcvbn: 'Password1!' scores reasonably here for using four character classes, even though it's a well-known weak password in practice, so treat the warnings list as a useful supplement, not the whole picture.

The crack-time estimate assumes 10 billion guesses per second against an unsalted, fast hash, a rough stand-in for a worst-case offline attack; a properly salted bcrypt or Argon2 hash would make real attacks vastly slower than shown here.

Frequently asked questions

Is this the same kind of strength check as zxcvbn?: No, it's a simpler character-set entropy model (length times log2 of pool size), so it won't catch things like common dictionary words or keyboard patterns the way a pattern-aware analyzer such as zxcvbn does.
Does the password I type get sent anywhere?: No, the entropy calculation and warnings are computed with plain JavaScript running in your browser tab, so the password you analyze is never transmitted or stored.
What does the crack time estimate actually assume?: It assumes an attacker running 10 billion guesses per second offline against a fast, unsalted hash and averages to about half the keyspace; a slow, salted hash like bcrypt makes real-world cracking far slower than this figure suggests.
Why did a long password still score as weak here?: If it only uses one character class, for example digits only or a single repeated character, the pool size used in the entropy formula stays small, so length alone doesn't raise the score much.