Category 9 — Cryptography / Security
Real-time entropy analysis, crack-time estimation, and improvement suggestions.
Type a password… field — the analysis updates on every keystroke.Online attack (1k/s), Offline fast hash (10B/s), and Offline slow hash (10k/s).Score Breakdown panel to see how length, character classes, and sequence/repeat penalties add up.Suggestions list to raise a weak score, and use Show/Hide to reveal the field.Get an instant entropy and crack-time read on an existing or candidate password instead of relying on "looks strong enough".
See the gap between a slow online guess, a fast GPU hash, and a slow KDF — the same password can crack in seconds or centuries depending on the scenario.
NIST now favors long passphrases over forced character classes. Watch how added length raises entropy far faster than a single symbol.
Sequence and repeat penalties plus a top-100 common-password check surface 123456, password, and keyboard walks that pure length misses.
Show teammates or clients the concrete bit count and crack time behind a password-policy decision.
Analysis runs entirely in your browser. Passwords are never uploaded, logged, or sent anywhere.
It estimates a password's entropy in bits — the logarithm of the number of possible guesses — then converts that into a crack-time estimate for three attack speeds.
The tool counts the character pool you use (26 lowercase, 26 uppercase, 10 digits, 33 symbols), multiplies length by log2(pool), then subtracts penalties for sequential runs like abc or 123 and for repeated characters.
Online attack (1k/s) models guessing against a live login form. Offline fast hash (10B/s) models a GPU cracking a fast hash like MD5. Offline slow hash (10k/s) models a slow KDF like bcrypt or Argon2. Each divides 2^bits by its guesses-per-second rate.
If it's built from sequences (123456), repeated characters, or appears in the top-100 common list, the sequence/repeat penalty and the common-password flag reduce its effective entropy.
The meter labels Good at roughly 36 bits and Strong/Very Strong above 50/70 bits. Aim for 50+ bits with a long, unique passphrase or a password manager.
No. It's a heuristic estimate based on character classes and common patterns — it can't know if the password is reused, leaked, or targeted. Use it as guidance, not proof.
Never. All analysis runs locally in JavaScript, and the password is never transmitted to or stored on any server.