Password Strength Score Calculator

score = 0.75 × min(100, entropy ÷ 100 bits × 100) + 6.25 × classes used − 45 (breached) − 20 (dictionary word), clamped to 0–100. Entropy carries three quarters of the score, scaled so that 100 bits earns full marks. Character-class variety contributes the remaining quarter, because it is what actually widens the charset an attacker must search. Two hard penalties then apply: a password that appears in a breach corpus is already a single lookup away from compromise, and one built on a dictionary word falls to a mangled-wordlist attack long before brute force.

A single score is what you can gate a signup form or an audit report on, and it prices in the two failures — reuse and dictionary words — that raw entropy maths completely misses.

This calculator takes 7 inputs: Password length, Contains lowercase letters, Contains uppercase letters, Contains digits, Contains symbols, Appears in a known breach corpus, Built around a dictionary word or name. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Because entropy is irrelevant once a password is on a list. Attackers try the list first, so a 20-character breached password falls in one guess while a random 10-character one survives billions. NIST SP 800-63B requires checking new passwords against a breach corpus for exactly this reason.

Browser meters mostly count characters and classes. This adds the entropy maths and the breach and dictionary penalties, which is closer to how tools like zxcvbn estimate real guessability.