Password strength expresses how resistant a secret string is to systematic guessing, brute-force enumeration, and dictionary reuse. It blends length, character-set diversity, and randomness into an entropy value measured in bits, then maps that metric onto human-readable safety bands such as “Weak” or “Strong”.
The calculator analyses the characters you type entirely in the browser. A lightweight reactive engine captures input, identifies character classes, computes entropy, benchmarks crack-time against typical hardware speeds, and flags common dictionary hits—all without server calls or cookies.
Use it before registering new accounts or rotating credentials at work; a quick check reveals whether adding two symbols and a digit turns a risky passphrase into a robust barrier. Avoid inspecting company or customer passwords on shared screens.
Password entropy quantifies unpredictability. The core variables are string length (L) and character-set size (S). Higher values multiply search space exponentially, slowing exhaustive attacks and widening the gap between casual guesses and theoretical worst-case attempts.
Entropy (H) | Category | Meaning |
---|---|---|
< 40 bits | Very Weak | Rapidly breakable |
40 – 59 bits | Weak | Low-effort compromise |
60 – 79 bits | Reasonable | Resists casual attacks |
80 – 99 bits | Strong | Secure for most uses |
≥ 100 bits | Very Strong | Impractical to brute-force |
Categories express the approximate resources required for compromise; moving up a band typically demands orders-of-magnitude more processing time.
Example (“Tr@nsp0rt-2025!”):
Category: Strong; a single high-end GPU would take roughly 300 million years to exhaust the space.
Shannon’s 1948 information theory defines entropy foundations. NIST SP 800-63-3 and ANSSI’s 2023 guidelines inform threshold selection and dictionary sizing debates.
This methodology processes non-sensitive text entirely client-side and aligns with GDPR principles of data minimisation.
Follow these quick actions to gauge and improve a password.