Password Strength
This tool evaluates the strength of your password based on its length and the character classes it uses, and calculates its entropy in bits – a measure of unpredictability. From the entropy it derives an approximate rating (weak to very strong) and a rough estimate of how long the password would take to crack by brute force. Everything runs locally in your browser and the password never leaves your device.
Estimated crack time: –
How password strength measurement works
The tool doesn't judge whether a password looks "nice" – it measures entropy, meaning how much uncertainty an attacker guessing character by character would face. First it determines how large a character set you used. For each character class present it adds that class's size to what's called the pool:
- lowercase letters
a–z→ +26 - uppercase letters
A–Z→ +26 - digits
0–9→ +10 - other characters (symbols, space, accents) → +33
The maximum pool size is therefore 95. From it, entropy is calculated with the formula bits = length × log2(pool), rounded to a whole number. Each character from a pool of 95 adds about 6.57 bits, while a character drawn only from lowercase letters adds just 4.7 bits – which is why a longer password using more classes grows quickly.
Based on the bits, the tool assigns a rating and estimates the cracking time. It assumes an attacker capable of 10 billion guesses per second and that the password falls, on average, after searching half of all combinations: time ≈ 2^bits / 2 / 10¹⁰ seconds. This is an indicative upper bound valid only for a truly random password – not a guarantee of security.
How to use the Password Strength tool
- Click into the Password field and start typing (or paste the password you want to test).
- Watch the character count, entropy bits and the word rating update in real time.
- Read the indicative cracking-time estimate below.
- Try making the password longer and adding symbols – you'll see entropy jump up.
An example of how the rating follows from the entropy:
| Password | Pool | Bits | Rating |
|---|---|---|---|
| heslo | 26 | 24 | weak |
| Heslo123 | 62 | 48 | medium |
| Tr0ub4dor&3x | 95 | 79 | strong |
| 16 random chars, all classes | 95 | 105 | very strong |
The rating thresholds are: under 40 bits weak, 40–59 medium, 60–79 strong, 80 and above very strong.
What the password strength test is good for
The tool is handy when you want to check a new password for an account, database or API key before you use it, or when you want to see clearly why length matters more than a few special characters. Because it computes the password only in your browser and never sends it anywhere, you can safely test even passwords you actually use – none is stored or transmitted over the network.
But treat the result as an estimate, not a verdict. The formula assumes the password is fully random. Real words, names, years, keyboard patterns (qwerty) or simple letter-to-digit swaps (a→@) fall to a dictionary attack far faster than a high bit count suggests – and the tool cannot detect such patterns. For maximum security use long random passwords from a generator, a different one for each service, and store them in a password manager.
FAQ
What does password entropy in bits mean?
Entropy in bits expresses how much uncertainty a password holds for an attacker guessing character by character. Each added bit doubles the number of possible combinations. As a rough guide: under 40 bits is weak, 60–79 bits is strong, and 80+ bits is very strong.
How does the tool calculate password strength?
First it determines the character-set size (pool) from the classes used: lowercase +26, uppercase +26, digits +10, other characters +33. Then it computes entropy with the formula length × log2(pool), rounded to whole bits. From the bits it derives the word rating and the cracking-time estimate.
Is my password sent to any server?
No. The entire calculation runs solely in your browser in JavaScript. The password is never uploaded, stored or transmitted over the network, so you can safely test even passwords you actually use.
Is a password with a high bit count guaranteed to be secure?
No. The estimate assumes a fully random password. If you use a common word, name, year or keyboard pattern, a dictionary attack will crack it far faster than the bit count suggests. High entropy is a necessary condition for security, not a guarantee.
Which is better – a long password or lots of symbols?
Usually length. Adding one character to a long password raises entropy more than swapping a letter for a symbol in a short one. The ideal is both: a long (16+ character) password using several character classes, preferably randomly generated.
How does the tool estimate cracking time?
It assumes an attacker capable of 10 billion guesses per second and that the password falls, on average, after searching half of all combinations: time ≈ 2^bits / 2 / 10¹⁰ seconds. This is a rough indicative figure, not a precise prediction – the real attack speed depends on the hardware and on how the password is stored.
Why is exactly 33 added for symbols?
The number 33 roughly matches the count of printable special characters on a typical keyboard (symbols, punctuation, space). Together with 26 lowercase, 26 uppercase letters and 10 digits it gives a maximum pool of 95 characters. Accented and other characters fall into the same "other" category.
Is it safe to test my real password here?
Yes, technically there's no leak risk – the password never leaves the browser. Even so, as a good habit don't test passwords on unknown sites; with this tool you can verify it's a static page that sends no data. To be safe, never enter passwords on sites you don't trust.
📅 Last updated: 11 July 2026