Analysis
Estimated time to crack
| Attack scenario | Time |
|---|---|
| Online (throttled) · 100/sec | — |
| Offline GPU · 10¹⁰/sec | — |
| Cloud cluster · 10¹²/sec | — |
Improvement suggestions
- Enter a password to see its strength.
How the score is calculated
This checker estimates strength the way cryptographers do: through entropy. Entropy (measured in bits) expresses how many possibilities an attacker has to search. A password's entropy is roughly its length multiplied by the base-2 logarithm of its character pool — a lowercase-only password draws from 26 characters, while a password using lowercase, uppercase, digits, and symbols draws from about 95.
The score from 0 to 100 is derived mainly from this entropy, then adjusted down for short length and for predictable patterns such as repeated runs or keyboard sequences. If your password matches one of the most common passwords (like 123456 or password), it is scored 0 immediately, because it will be guessed in the first seconds of any attack.
Why "time to crack" varies so much
We show three scenarios. An online attack is limited by a website's rate limit (we assume 100 guesses per second), which makes even modest passwords hard to brute-force. An offline attacker with a stolen password hash and a modern GPU can try roughly 10 billion (10¹⁰) guesses per second. A well-funded cloud cluster can reach a trillion (10¹²) per second. That is why the same password can last years online yet fall in seconds offline.
The numbers are estimates — they assume the attacker must search the whole keyspace and ignore smarter techniques like dictionary or credential-stuffing attacks. Use them as a relative guide, not a guarantee.
Explore more tools
- Passphrase generator — build memorable, high-entropy passphrases from random words.
- Entropy → crack time — see how any entropy value maps to time for each attack scenario.
- Password security tips — practical guidance for staying safe online.