Password Strength Checker

Password strength checker with crack-time estimates

This password strength checker estimates how hard a password would be to guess and explains why. Instead of a single colored bar, it shows the character set it detected, an entropy figure in bits, the estimated time to crack under four realistic attack speeds, and specific warnings about patterns that attackers try first.

How the strength estimate works

The starting point is brute-force entropy: length multiplied by log2 of the character pool. Lowercase letters add 26 to the pool, uppercase 26, digits 10, printable symbols 33, and non-ASCII characters a further 100. A 12-character password drawing on all four ASCII groups starts near 79 bits.

Real attackers do not brute-force blindly, so the checker then lowers the estimate for patterns:

• Exact or leetspeak matches against a list of the most common passwords (P@ssw0rd counts as password).
• Common passwords hidden inside a longer string.
• Three or more repeated characters, alphabetical or numeric runs, and keyboard rows such as qwerty or 1qaz2wsx.
• Anything that looks like a year from 1900 to 2099.
• The classic "Capitalized word + digits + optional symbol" shape.
• Passphrases of three or more plain words, which are scored as random Diceware words at about 12.9 bits each rather than as individual letters.

The final entropy maps to a score: under 28 bits is Very weak, under 36 Weak, under 60 Fair, under 80 Strong, and 80 or more Very strong.

Example

Checking the sample password Summer2024! returns:

Strength:      Fair (2/4)
Length:        11 characters
Character set: lower, upper, digits, symbols (pool ≈ 95)
Entropy:       ≈ 40.4 bits

Estimated time to crack (average case):
  Online attack, rate-limited (100 guesses/hour)       8.1 × 10^3 centuries
  Online attack, unthrottled (10 guesses/s)            22 centuries
  Offline, slow hash like bcrypt (10 thousand/s)       2 years
  Offline, fast hash like MD5 on GPUs (100 billion/s)  7 seconds

Warnings:
  • Contains what looks like a year — easy to guess if it relates to you.
  • "Word + digits + symbol" is the pattern crackers try first.
  • Consider 12+ characters; length adds more strength than symbols.

It uses all four character types, yet it would fall in seconds if a site stored it as unsalted MD5 and the database leaked. The pattern warnings explain why it scores only Fair.

Reading the four attack scenarios

How long a password survives depends as much on the website as on you. An online attack against a login form with rate limiting is extremely slow. An offline attack, where someone has a copy of the password database, runs as fast as their hardware allows: a slow hash such as bcrypt or Argon2 keeps guesses in the thousands per second, while a fast hash like MD5 allows billions. Because you usually cannot know how a site stores passwords, aim for a password that survives the fast offline row.

What makes a strong password

• Length beats complexity. Each extra character multiplies the search space; swapping a for @ barely helps because cracking rules try it automatically.
• Randomness beats cleverness. Four or five words chosen by dice or a generator are both strong and memorable. Words you picked yourself are far more predictable.
• Uniqueness matters most. A strong password reused on a breached site is instantly usable elsewhere. A password manager solves this.

Generate a truly random one with the password generator or a word-based one with the memorable password generator. If you store passwords in your own app, hash them with the Argon2 hash generator or bcrypt so the offline scenarios stay slow.

Limitations

These are estimates, not guarantees. The checker assumes an attacker knows your character set, and it only knows a short list of common passwords, not the billions in real breach corpora. A password built from your name, pet or birthday may score well here but still be easy for someone who knows you. Treat the result as an upper bound.

Privacy

The analysis runs entirely in your browser with JavaScript. Your password is not uploaded, logged or stored, and the check works even if you disconnect from the internet after the page loads.

Password strength checker in Python

A basic password strength checker in Python needs only math and string: add up the size of every character group the password uses, then multiply the length by log2 of that pool to get the entropy in bits. The catch is that the formula assumes every character was chosen at random. It gives Summer2024! about 72 bits and calls it strong, although a capitalized word followed by a year and a symbol is a pattern that guessing tools try early.

import math
import string

GROUPS = [(string.ascii_lowercase, 26), (string.ascii_uppercase, 26),
          (string.digits, 10), (string.punctuation + " ", 33)]

def entropy_bits(password):
    pool = sum(size for chars, size in GROUPS if any(c in chars for c in password))
    return len(password) * math.log2(pool) if pool else 0.0

def label(bits):
    for limit, name in [(28, "Very weak"), (36, "Weak"), (60, "Fair"), (80, "Strong")]:
        if bits < limit:
            return name
    return "Very strong"

for password in ["kV9#mQz7!pLw", "Summer2024!"]:
    bits = entropy_bits(password)
    print(f"{password:<14}{bits:5.1f} bits  {label(bits)}")

The checker on this page starts from the same number and then lowers it for such patterns: it agrees on 78.8 bits for the random first password, but rates the second at about 40 bits.