What's a strong password?

60+ bits of entropy is the minimum for things that matter; 80+ for secrets that protect money or PII; 100+ for cryptographic keys. A 4-word passphrase from a 7,776-word list (Diceware) is ~52 bits — strong with a slow hashing function like bcrypt.

Is 'P@ssw0rd!' strong?

Despite checking all the 'complexity' boxes (upper, lower, digit, symbol), no. It's near the top of every dictionary attack's wordlist. The tool catches this — character substitution is well-known and adds almost zero real entropy.

Why does the meter sometimes show different scores for similar-looking passwords?

Pattern detection. correcthorsebatterystaple is high entropy (random English words). password123456789 looks long but has near-zero entropy (everyone tries it). The meter weights both length and unpredictability.

Is my password sent anywhere?

No — scoring is entirely local. The meter never makes a network request with your password.

entropy · crack-time · score · local

Score password strength

Live entropy meter, score, and crack-time estimate against a 10-billion-guess-per-second adversary. Nothing leaves your browser.

Password Strength Meter

Score

0/100

Very weak

Entropy

0 bits

Length

chars

Status

—

live

input · password

Very weak0/100

output · analysis

Length

Entropy

0.0 bits

Crack @10B/s

instant

Quick Start

How strength scoring works

We compute the alphabet from the character sets used, multiply by length, then subtract penalties for common patterns and short lengths.

01
Type your password
Toggle show/hide as you go.
Inputs are treated as UTF-8 throughout the pipeline and validated client-side as you type — nothing dispatches until the value is well-formed.
inpututf-8client-sidevalidated
input · textsecret · set
```
••••••••
```
loaded · parsedclient-side
02
Entropy in bits
log2(alphabet) × length. Adds char-set bonuses.
Each toggle re-computes through a memoised hook, so flipping options never resets your input and the UI stays snappy on large inputs.
bitsoptionslivememoisedtoggles
entropy · memoisedbits · live
```
62 bits
```
options set · memoisedlive
03
Pattern penalties
Common words, sequences, and repeats trim the score.
Randomness — where used — comes from crypto.getRandomValues, never Math.random. Heavy work sits in useMemo.
penaltycomputeinstantlocaldeterministic
warn · instantpatterns · computed
```
-15: repeats
```
computed · instantinstant
04
Crack-time estimate
Assumes 10B guesses/sec — modern GPU rig at offline attack.
Copy writes through navigator.clipboard and downloads use a Blob — zero network traffic. Same input plus same options always yield the same bytes.
timecopydownloadzero-networkreproducible
ok · copiedready · copied
```
3 years
```
shipped · ready to shipsuccess

Pro tips

Pro tips for everyday utilities

Reach for crypto.getRandomValues

Cryptographically random for IDs, tokens, salts. Math.random is for animation and games, not security.

Sort IDs lexicographically

UUID v4 has no time ordering. Use ULID or UUID v7 if you need sorted IDs.

Mock data with seeds

Faker-style libraries can be seeded so tests are reproducible. Embed the seed in the fixture file.

Reference cards beat memory

Cheatsheets for Vim, Git, Docker, Linux signals are faster than man pages when you’re mid-flow.

Browser APIs vary

Touch events, gamepads, and clipboard differ across vendors. Feature-detect before use.

Persist in the right place

localStorage for user preferences, sessionStorage for transient state, IndexedDB for structured data.

Use Cases

When to check strength

Audits, onboarding, training.

Self-audit

Score reused passwords before rotating. Random values come from crypto.getRandomValues — cryptographically secure for tokens, salts, and session IDs. Math.random is deterministic enough for animations but predictable enough to be a security bug.

CSPRNG-backed

User training

Show why 'P@ssw0rd' fails. Pair with hashids, ULID, or UUID v7 when you need both random and sortable — useful for primary keys, public-facing IDs, and event log ordering without a sequence column.

reproducible

Policy thresholds

Set 'min 60 bits' for your team. Output is deterministic given the same seed, so fixtures and tests stay reproducible across CI runs and contributor machines. Embed the seed in the fixture file for full replay.

snappy

Pre-flight check

Verify before saving to a vault. Heavy work runs through useMemo so the UI stays snappy on large inputs. Same input + same options yields identical bytes — the kind of stability snapshot tests rely on.

feature-detected

Pen test

Cross-check against known-bad lists. Storage tools persist to the right backend: localStorage for user preferences, sessionStorage for transient state, IndexedDB for structured data. Pick the right shelf and quota worries disappear.

deterministic

Workshops

Live demos of how length crushes brute force. Browser feature detection: clipboard, fullscreen, gamepad, and Web Bluetooth APIs gracefully fall back when unavailable. No surprise white screens on Safari or older Firefox.

production-ready

FAQ

Frequently asked questions

How accurate is entropy?

Length × log2(alphabet) is an upper bound for fully random strings. Real human-chosen passwords often have far less true entropy.

Why 10B/s?

A reasonable rate for a modern GPU rig cracking fast hashes offline. Slow hashes (bcrypt) lower this drastically.

Should I use this score as policy?

It's a screening tool. Pair with a HIBP-style breach check and rate limiting before relying on it.

Does typing log anywhere?

No — all scoring happens in your browser, no network call ever made.

Is anything sent to a server?

No. Strength scoring runs locally — your password never leaves the browser.

Suggest a tool

Something missing?

Tell us what you need. We ship the top requests every two weeks.

47 in queue·8 shipped this month

Request queued. Thanks!