All tools

Password strength estimator

Type a password to see roughly how long it would resist brute-forcing. It runs entirely in your browser — what you type is never sent anywhere, and isn't stored. Still, don't paste a password you actively use; type a close variant instead.

Password to test

Show what I'm typing This measures the search space from length and the character types you use. It does not detect dictionary words, names, dates, or keyboard patterns — a real attacker does, so treat the result as an optimistic ceiling.

Entropy: —
Strength: —

Online attack (1k/s): —
Offline attack (100B/s): —

What this estimate means. It computes a character-pool entropy — length × log₂(pool size) — and the average time to find the password by brute force at two speeds: a throttled online login (1,000 guesses/second) and a well-funded offline attack on captured data (100 billion/second). Because it can't see patterns — Password1!, qwerty, your birthday — a guessable password can score far higher here than it truly is. For a secret that's strong under any model, use the passphrase generator: random words have no pattern to exploit.