Password Strength
Evaluate password strength and estimated crack time based on complexity.
About Password Strength
Strength is estimated from entropy — the length multiplied by the base-2 log of the character pool size. More characters and more variety (upper, lower, digits, symbols) exponentially increase the number of possible passwords and the time to crack them.
Formulas
Entropy
Entropy (bits) = password length × log₂(character pool size)
- H
- Entropy in bits
- L
- Password length
- N
- Size of the character pool inferred from the classes present (a–z: 26, A–Z: 26, 0–9: 10, symbols: 32)
Estimated crack time
Crack time ≈ 2^entropy ÷ guesses per second
- t
- Estimated time to exhaust half the search space (seconds)
- H
- Entropy in bits
- G
- Assumed offline attack speed (10 billion guesses/sec)
Worked example
With the default values below, Password Strength returns Strength of Strong. Change any input above and every figure here is recalculated in your browser.
Inputs used
- Password to Test
- Sunshine123
Results
- Strength
- Strong
- Entropy (bits)
- 65.5
- Est. Offline Crack Time
- 165 years
Step by step
- 1Detect character classes present in the password= pool = 62All analysis runs locally in your browser. The password is never transmitted.
- 2Entropy = length × log₂(pool size)= 65.5 bits
- 3Estimated offline crack time at 10 billion guesses/second= 165 yearsAssumes an offline brute-force attack. Dictionary words, common patterns, and credential breaches are not modelled.
- 4Strength rating= Strong
Assumptions and limits
- The result is derived only from the single input listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
- Figures are rounded for display to 1 decimal place, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.
- This is an educational estimate of theoretical strength and does not account for dictionary words, reuse, or breaches. Use a password manager for real accounts.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
This is an educational estimate of theoretical strength and does not account for dictionary words, reuse, or breaches. Use a password manager for real accounts.
Frequently Asked Questions
Is my password sent anywhere?
No. The check runs entirely in your browser; the password never leaves your device.
Why does a long simple password beat a short complex one?
Entropy grows linearly with length but only logarithmically with pool size, so adding characters usually helps more than adding symbol variety. A long passphrase is often stronger and easier to remember.