Password Strength Test

Yes. This tool runs entirely in your browser using JavaScript. Your password is never sent to any server, stored in any database, or transmitted over the network. You can verify this by disconnecting from the internet after the page loads -- the tool will continue to work.

Entropy measures the randomness of a password in bits. Higher entropy means more possible combinations an attacker must try. For example, a 12-character password using uppercase, lowercase, numbers, and symbols has about 79 bits of entropy, meaning there are 2^79 (about 604 sextillion) possible combinations. Aim for at least 60 bits for online accounts and 80+ bits for sensitive systems.

The crack time assumes a modern GPU cluster performing 10 billion guesses per second (a realistic rate for offline attacks against unsalted hashes). The calculation is: total combinations (2^entropy) divided by twice the guessing rate (average case). Real-world times vary based on hashing algorithm, salting, and available hardware.

A strong password combines length (12+ characters), character variety (uppercase, lowercase, numbers, and symbols), and randomness (no dictionary words, names, dates, or keyboard patterns). The single most impactful factor is length -- each additional character exponentially increases the number of combinations. Using a password manager to generate and store random passwords is the best approach.

Passphrases (like "correct horse battery staple") can be excellent passwords because they are long and memorable. A 4-word passphrase from a large dictionary provides about 44-55 bits of entropy, while 5-6 words can reach 70+ bits. For maximum security, combine a passphrase with numbers and symbols, or use a randomly generated password stored in a password manager.