Password Strength Tester

How to use Password Strength Tester

1. Type or paste a password — use the reveal toggle if you need to check what you typed.
2. Read the strength rating, the entropy estimate and which checks passed.
3. Treat a weak result as decisive and a strong result as provisional: if the password contains a word, a name or a date, it is weaker than the score suggests.
4. The analysis runs entirely in your browser — nothing is transmitted, logged or stored.
5. It checks a list of about 900 of the most-used passwords (including simple swaps such as 0 for o), sequences, repeats, years and words from the EFF passphrase list. It does not know names, other words or breach databases.
6. Check whether a password has appeared in a known breach separately, using a service that does that specifically.

What the entropy figure assumes, and when it lies

The starting figure is length × log₂(character set size): a 12-character password using all four classes scores about 79 bits (94 printable characters, the same set the password generator draws from; a space adds one more). That is correct only if the password was chosen at random. The tester catches the obvious cases — “Password123!” is a listed password with digits and a symbol added, so it rates Very weak — but a pet’s name plus a birthday is on no list it holds, and an attacker’s rules will still find it quickly. Read a high score here as “structurally adequate”, never as “safe”.

Passphrases are counted by words

If the password splits into two or more words from the EFF passphrase list (the 7,776 words the passphrase generator uses), it is also estimated as words × log₂ 7,776 — about 12.9 bits a word — plus a little for separators, capitals and any leftover characters, and the lower estimate wins. The result says which method was used, for example “Estimated as 4 dictionary words”. That is why “correct-battery-staple-tiger” rates Fair (about 57 bits) rather than the 160-plus bits its 28 characters would suggest: an attacker guesses words, not letters. Words that are not on the list are priced as random letters, so a passphrase of everyday words outside it can still be overrated.

What a dictionary attack actually does

Nobody brute-forces from aaaa upward. They start with leaked password lists — hundreds of millions of real passwords from real breaches — then apply transformation rules: capitalise the first letter, append a year, swap a for @, swap o for 0, add an exclamation mark. Those rules exist because they describe what people actually do. A password built from a word and a pattern falls to this regardless of how many character classes it contains, which is why randomness matters more than complexity.

The crack-time estimate is a rough upper bound

It assumes exhaustive search at ten billion guesses a second, which is a reasonable figure for a fast hash on consumer GPU hardware. Reality varies enormously in both directions: against bcrypt with a decent cost factor, offline guessing is thousands of times slower, while a well-resourced attacker with many GPUs is far faster. And a password in a breach dictionary takes no time at all, whatever this says. Treat the figure as an order of magnitude for random passwords and as meaningless for guessable ones.

What actually protects an account

In order of real-world impact: a different password for every site, so one breach stays contained; two-factor authentication, which defeats a stolen password outright; a password manager, which makes the first two practical; and length. Brute force is near the bottom of the list of how accounts are actually lost — reuse, phishing and breaches are the top three, and none of them care how many symbols you used.