Skip to content
Home Services Book
§
§ · free tool

Password strength tester. Entropy, not vibes.

Type any password and see its real entropy in bits, an estimated crack time, and exactly which weak spots to fix. Analysed entirely on your device — your password is never transmitted, logged, or stored.

See custom web platforms Book a call WhatsApp
A free online tool by Digital Heroes
Waiting… 0 bits of entropy
Length
0
Character pool
0
Crack time*
—

Your password is analysed locally with JavaScript and never transmitted, logged, or stored. Nothing leaves this tab — close it and the password is gone. It is never autofilled or saved.

Checklist

How crack time is estimated

We estimate entropy as bits = length × log₂(pool size), where the pool is only the character sets you actually used (26 lowercase, 26 uppercase, 10 digits, ~33 symbols). When a common password, dictionary word, sequence, or repetition is detected, the effective entropy is reduced because an attacker would try those first.

Crack time assumes an offline attacker who has the leaked hash and guesses at 10 billion guesses/sec (a strong consumer GPU against a fast hash like unsalted SHA-1):

*This is a guide, not a guarantee. A slow, salted hash (bcrypt/argon2) would take far longer to crack; a weak reused password could fall instantly to a credential-stuffing list regardless of entropy. Use a password manager and unique passwords everywhere.

§ 02 · what you can do

Everything a strength check should show.

  • Measure entropy in bits for any password you type or paste, updated live as you type.
  • See an estimated crack time across four attacker scenarios — online throttled, slow salted hash, fast single GPU, and a large GPU cluster.
  • Run a security checklist covering length, character mix, common passwords, dictionary words, sequences and repeats.
  • Get fix-it tips that name exactly what is weakening your password and how to strengthen it.
  • Toggle visibility to verify what you typed without leaving it exposed on screen.
  • Test privately: everything runs in your browser and nothing is ever uploaded.
§ 03 · how to use it

Four steps, no manual.

  1. Type or paste a password into the test field — results update instantly as you type.
  2. Read the strength label, entropy score and crack-time estimate in the stat boxes.
  3. Use the eye button to reveal or hide the characters while you check them.
  4. Review the checklist and fix-it tips to see what to change, then push it toward “Excellent.”
§ 04 · faq

Frequently asked questions.

Is the Password Strength Tester free?
Yes — completely free for everyone. No sign-up, no account and no usage limits.
Is my password uploaded or stored anywhere?
No. Your password is analysed entirely in your browser on your own device. It is never transmitted, logged or stored — close the tab and it is gone.
What does entropy in bits actually mean?
Entropy measures how unpredictable a password is. We compute it as length × log₂ of the character pool you used, then reduce it when we detect common passwords, dictionary words, sequences or repeats. Roughly: under 40 bits is weak, 60–80 is strong, and 80+ is excellent.
How is the crack time calculated?
We assume an offline attacker with the leaked hash guessing at 10 billion attempts per second, and take the average guesses to find as half the keyspace. It is a guide, not a guarantee: a slow salted hash takes far longer, and a reused password can fall instantly to a credential-stuffing list.
Should I type my real password in here?
Because nothing leaves your browser, it is safe to test here. As a good habit, though, treat this as a pattern check — the best practice everywhere is a password manager generating unique, random passwords you never have to see or type.
Does it work offline?
Yes — once the page has loaded, all analysis runs locally, so it keeps working with no connection.

Published · Last updated .

Online now

Hi there. How can we help you today?

Reply