Online Tool Store
Password Strength Checker
Check a password's entropy, estimated crack time, and common-password risk with a live strength meter and checklist. Runs entirely in your browser.
🔒 This tool runs entirely in your browser. Your files are never uploaded to a server.
Example shown — type your own. Nothing is sent anywhere; everything is calculated on your device.
- Entropy
- —
- Length
- —
- Est. crack time
- —
Assumes 10 billion guesses/second — a fast offline attack against a leaked hash.
How it works
- Type a password — nothing leaves your browser.
- The strength meter, entropy, and estimated crack time update as you type.
- Use the checklist to see exactly what would make it stronger.
The formula
Entropy measures how many attempts a brute-force attacker would need, on average, to guess the password:
Entropy (bits) = Length × log₂(character set size)
Crack time ≈ 2^Entropy ÷ guesses per second ÷ 2
Example: an 11-character password mixing upper/lowercase, digits, and symbols has a character set of about 95, giving roughly 11 × log₂(95) ≈ 72 bits of entropy.
FAQ
Is my password sent anywhere while I type it?
No. Every check — entropy, the crack-time estimate, the common-password list — runs locally with JavaScript. Nothing is transmitted, logged, or stored, and the password field also isn't part of any form that could submit it.
How is the crack-time estimate calculated?
From the password's entropy (length × log2 of the character-set size used) against an assumed 10 billion guesses per second — a realistic rate for an attacker running a fast offline attack against a stolen password hash. Real attacks vary a lot depending on the hashing algorithm the target used.
Why does a long password with only lowercase letters still get flagged?
Entropy depends on both length and the size of the character set. A 20-character password using only lowercase letters has less entropy per character than a shorter one mixing upper/lowercase, numbers, and symbols — length matters most, but variety matters too.
What does the "common leaked passwords" warning check?
It compares your input against a small built-in list of the most frequently breached passwords (things like "123456" and "password1"). It's a basic sanity check, not a full breach-database lookup — a password can still be reused elsewhere even if it doesn't trigger this warning.
How we compare
| Feature | Online Tool Store | Your browser's password manager | Random password-strength sites |
|---|---|---|---|
| Works on a password you already chose, no generation needed | ✓ | Mainly generates new ones | ✓ |
| No file upload — runs in your browser | ✓ | ✓ | Some send it to a server |
| No ads | ✓ | ✓ | Ad-supported |
A password that touches a server — even "just to check strength" — is a password you probably shouldn't trust with that server. This one never leaves the page.