Password Strength Checker: Guesses, Entropy and Crack Time

How to use it

Type a password in the Password field. It is hidden; press Show to read what you typed.
Read the Estimated entropy and the Strength label. Higher bits mean more guesses for an attacker.
Check the Time to crack lines for the three stated rates, and the NIST checks below them.
Look at Patterns found to see which parts of the password a guesser would try first.

How the estimate works

Each character that no pattern covers costs log2 of the pool, the number of characters the password's classes allow: 26 lower-case letters, 26 capitals, 10 digits, 33 symbols and space, and 100 for other characters. A pattern costs its own bits: a word from the common-password list costs the bits of its rank, a repeat or a run in order costs little, and so does a walk of neighbouring keys or a year.

The estimate is the cheapest way to split the password into characters and patterns. The order in which a guesser would try the parts is not counted, so the estimate can be a little low. Each figure is a model for scale, not a measurement of any real attack.

entropy if random = length x log2(pool);   estimate = the cheapest split into characters and patterns

What NIST SP 800-63B says

A password used on its own must be at least 15 characters, and a password used only as part of multi-factor login may be 8. A verifier should accept at least 64 characters and should accept spaces and all printable characters.

Verifiers must not impose composition rules such as a mix of types, and must not force a periodic change unless there is evidence the password was compromised. They must compare the whole password with a list of common or compromised passwords, they should permit pasting, and they must allow password managers and autofill.

Worked example: Password2026

Password2026 has 12 characters from 62 possible (lower case, capitals and digits), so if it were random its entropy would be 12 x log2(62), which is 71.5 bits.

Its pattern is cheap: password is the first word of the common list (rank 1), which costs 0 bits plus 1 bit for the capital P, and 2026 is a year, which costs log2(140), about 7.1 bits. The estimate is 8.1 bits: weak, and about 280 guesses on average, so it falls in a fraction of a second even at the online rate.

Frequently asked questions

Is the password sent to a server or stored?

No. The page analyses the password in your browser and makes no request that contains it. The list of common passwords is a file this site serves, so the page loads it, but the password itself is never sent, and reloading the page forgets it.

Why is Password1! weak when it has a capital, a digit and a symbol?

Guessers try common words first, with the usual additions, so the mix of types adds little. NIST SP 800-63B gives this very example and finds that composition rules add little; length and a check against common passwords matter more.

What does the entropy figure mean?

It is the number of bits in the password's estimated choice. Each extra bit doubles the guesses needed on average, so 60 bits is far harder to guess than 40.

Why do the three times differ so much?

They use three stated rates: an online attack with no rate limit, an offline attack on a slow hash, and an offline attack on a fast hash on a graphics card. Real attackers differ from all three; the rates show the scale only.

Does a strong result mean the password is safe to use?

Not on its own. The page does not check whether the password was leaked or reused on another site. Use a different password for each account, and a password manager to keep them.

Why 15 characters, when NIST allows 8?

NIST sets 15 for a password used alone and allows 8 when it is one factor of a multi-factor login. The page shows the single-factor figure, because it is the stricter one.

Why is the list of common passwords so short?

NIST advises a blocklist of commonly used values, and says an excessively large list adds little. The page uses the 10,001 most common passwords in the SecLists list, which is published under the MIT licence.

Sources

Figures and text last checked on Tuesday, November 10, 2026.