Passwords are secret character strings that gate access to accounts and data, and their strength depends on length, variety of symbols, and how predictable the pattern is. A stronger password resists guessing for longer so the practical goal is a string that balances memorability with high resistance to automated attacks.
You choose the length and which types of characters to include, then create a candidate and review two quick signals of quality. An entropy estimate summarizes how many bits of unpredictability the selection carries, and a separate strength score reflects common pattern weaknesses found by a strength estimator.
Results update as options change so you can test short and long strings and see the effect of including uppercase letters, lowercase letters, numbers, and symbols. You may also exclude lookalike characters to avoid slips when reading or typing, and you can allow only unique characters if you prefer no repeats.
A realistic example is a 12 character mix with lookalikes removed that shows about 77.1 bits of entropy and an estimated crack time around 517 k years at ten billion guesses per second. Treat these as guides rather than promises and avoid reusing the same password across services.
The measurable quantities are password length and the active character pool size. From these, an information measure in bits is computed to summarize unpredictability, and a separate strength score from a heuristic estimator maps to five labels that range from Very Weak to Strong. Estimates reflect snapshot difficulty against blind guessing rather than targeted attacks.
Entropy in bits is modeled as length times the base two logarithm of the active pool size, which assumes uniform independent selection from the chosen characters. A crack time is then estimated by dividing the total number of combinations by a fixed guess rate and expressing the result as hours, days, years, or thousands of years.
Interpretation follows two tracks. Higher bit counts indicate more possibilities, and the score label summarizes recognizable patterns that reduce practical strength. Values near boundaries should be read cautiously because a small change in length or pool size can shift the label while only modestly changing overall resistance.
Comparisons are meaningful only when options are held constant. Removing lookalike characters reduces the pool but can reduce user error. Enabling unique characters samples without replacement until the pool is exhausted, then restarts, which keeps variety high for typical lengths well below the pool size.
| Symbol | Meaning | Unit/Datatype | Source |
|---|---|---|---|
| L | Password length | integer | Input |
| N | Active character pool size | integer | Derived from options |
| H | Entropy | bits | Computed |
| C | Total combinations | count | Computed |
| g | Guess rate | 1010 guesses/s | Constant |
| t | Crack time estimate | seconds, days, or years | Computed |
Options: uppercase, lowercase, numbers, symbols enabled; lookalikes excluded; length L = 12. Pool size N = 86. Entropy H = 12 × log2(86) ≈ 77.1 bits.
Interpretation: with these settings, blind guessing is impractical; changing length or pool membership adjusts both estimates directly.
| Score | Label | Progress indicator |
|---|---|---|
| 0 | Very Weak | 20 % |
| 1 | Weak | 40 % |
| 2 | Fair | 60 % |
| 3 | Good | 80 % |
| 4 | Strong | 100 % |
Decimal separator is a dot. Entropy displays one decimal place. Crack time shows thousands of years with one decimal and whole years, days, or hours otherwise. Strength progress advances in fixed 20 % steps.
| Field | Type | Min | Max | Step/Pattern | Error Text | Placeholder |
|---|---|---|---|---|---|---|
| Length | Number | 1 | 100 | Integer | None | None |
| Uppercase | Checkbox | — | — | Boolean | None | None |
| Lowercase | Checkbox | — | — | Boolean | None | None |
| Number | Checkbox | — | — | Boolean | None | None |
| Symbol | Checkbox | — | — | Boolean | None | None |
| Exclude ambiguous | Checkbox | — | — | Boolean | None | None |
| Unique characters | Checkbox | — | — | Boolean | None | None |
No data is transmitted or stored server‑side; generation, strength estimation, and file or clipboard actions occur in the browser.
Password strength and estimated resistance are produced from your chosen length and character pool.
Example: Length 16 with letters, numbers, and symbols, ambiguous excluded, yields a high entropy result with a Strong label.
When satisfied, copy the password or download a text copy for your password manager.
Clipboard and files are created locally. No. Generation, evaluation, and copying happen in the browser. Nothing is sent to a server.
It assumes each character is chosen uniformly from the active pool. Real strength can be lower if human patterns appear.
It summarizes common weaknesses such as dictionary words or predictable patterns. Strong indicates better resistance than Fair or Good.
Zero, lowercase o, uppercase O, digit one, lowercase l, and uppercase I are removed when the option is enabled.
Yes. Unique characters avoids repeats until the pool is exhausted. If length exceeds the pool, repeats can occur afterward.
Yes. Once the page is loaded, generation and strength evaluation continue entirely in the browser.
Set length to 16, enable letters and numbers, disable symbols, then generate and review the estimates.
Increase length or add more character types. Excluding lookalikes reduces the pool slightly and may lower the estimate.