Analyzed live as you type. Prefer not to type a real password — try a pattern like the ones you usually use.
no password
The math, in the open
Entropy starts as length × log₂(pool size), then gets adjusted downward for every pattern found below.
Pattern findings
Human habits are what make passwords weak. Each finding explains what was detected, why attackers exploit it, and roughly what it costs you.
Generate instead
A way out, not just a verdict. Uses crypto.getRandomValues() with rejection sampling (no modulo bias). Nothing is stored or transmitted.
Methodology & honest limits
The entropy model
Base entropy is the textbook upper bound: E = L × log2(N), where L is the
length in characters and N is the size of the character pool the password draws from
(lowercase 26, uppercase 26, digits 10, ASCII symbols 33, extended/Unicode counted as a 128-character pool).
That number is only honest if every character were chosen uniformly at random — which human passwords never are.
So this tool treats L × log2(N) as a ceiling and subtracts penalties for every
detectable human pattern: keyboard walks, sequential runs, repeated characters and substrings, dates and years,
leetspeak, embedded dictionary words (matched against an embedded list of 5,000 common words after leet
normalization), and the classic word+digits+symbol shape. The displayed number is the adjusted figure, and the
breakdown above shows the subtraction explicitly.
Attacker assumptions
| Scenario | Guesses/sec | What it models |
|---|---|---|
| Online throttled | 10² | A login form with rate limiting / lockouts |
| Offline fast hash | 10¹¹ | Leaked DB with unsalted MD5/SHA-1, rented GPU rig |
| Offline slow hash | 10⁵ | Leaked DB with bcrypt/scrypt/argon2 at sane cost |
Time-to-crack is the average case: 2^(E−1) / rate. Real attackers go smartest-first
(dictionaries, rules, leaks), so weak passwords fall far sooner than the average — which is exactly what
the pattern penalties approximate.
Verdict bands
<28 bits trivially cracked · <36 very weak · <60 online-attack resistant · <90 offline-attack resistant · <128 strong · ≥128 effectively uncrackable. Rough anchors: ~80 bits is beyond any realistic offline attacker today; 128 bits is beyond brute force, period.
Limits
- Any client-side estimate is a model, not an oracle. It cannot know that your password appeared in a breach corpus, is your dog’s name, or is reused on twelve sites — all of which matter more than entropy.
- Pattern penalties are heuristics, calibrated to be directionally honest, not precise. Two analyzers can legitimately disagree by 10–20 bits on patterned input.
- The dictionary covers 5,000 common English words; other languages and proper nouns are under-detected.
- Entropy says nothing about phishing, keyloggers, reuse, or reset flows. Use a password manager and turn on 2FA.