Password Strength Calculator

How to Use the Password Strength Calculator

Type or paste a password into the input field. The calculator instantly analyzes it and shows a strength rating from Very Weak to Very Strong, a score out of 7, entropy in bits, the character pool size, and an estimated crack time against a brute-force attack. The character analysis panel shows which types of characters are present. No passwords are stored or transmitted; all analysis happens locally in your browser.

The strength score considers password length, character variety (lowercase, uppercase, digits, symbols), and entropy thresholds. Meeting more criteria earns a higher score. A score of 5 or above is generally considered strong for everyday accounts. For high-security accounts like banking or email, aim for 6 or 7.

Understanding Password Entropy

Entropy measures the unpredictability of a password. It is calculated as the number of characters multiplied by log2 of the character pool size. For example, using all 95 printable ASCII characters (26 lowercase + 26 uppercase + 10 digits + 33 symbols), each character adds about 6.57 bits of entropy. A 12-character password from this pool has approximately 78.8 bits, which is considered strong.

Why Length Beats Complexity

Adding one character to a password multiplies the number of possible combinations by the pool size. Going from 8 to 12 characters with a 95-character pool increases combinations from 6.6 quadrillion to 54 septillion, making the password about 8 million times harder to crack. Meanwhile, adding symbols to a short password provides a much smaller improvement. This is why security experts now recommend long passphrases over short, complex passwords.

Best Practices for Creating Passwords

Use a unique password for every account. Consider using a passphrase of 4-5 random words for memorability and strength. Enable two-factor authentication wherever possible. Use a reputable password manager to generate and store strong, unique passwords. Avoid using personal information, common words, keyboard patterns, or previously breached passwords. Check your passwords against known breach databases like Have I Been Pwned.

Frequently Asked Questions

How is password strength measured?

Password strength is measured by entropy, which represents the number of possible combinations an attacker must try. Entropy is calculated as the password length multiplied by log2 of the character pool size. A password using lowercase, uppercase, digits, and symbols has a pool of 95 characters. More entropy bits means more combinations and a stronger password.

What makes a strong password?

A strong password is at least 12 characters long and includes a mix of lowercase letters, uppercase letters, digits, and special symbols. Avoid dictionary words, common substitutions (like @ for a), personal information, and patterns like 123 or qwerty. Length is the single most important factor.

What is password entropy?

Entropy measures the randomness of a password in bits. It equals the length times log2 of the character pool size. For example, an 8-character password using all 95 printable ASCII characters has about 52.6 bits of entropy. Security experts recommend at least 60-80 bits for important accounts.

How long would it take to crack my password?

Crack time depends on the number of possible combinations and the attacker's speed. A modern GPU cluster can try about 1 billion passwords per second. An 8-character lowercase password would take about 3.5 minutes. Adding uppercase, digits, and symbols extends this dramatically.

Is a longer password always better than a complex one?

Generally yes. A 16-character lowercase password has more entropy (75.2 bits) than an 8-character password using all character types (52.6 bits). Each additional character multiplies the total combinations by the pool size, making length the most effective way to increase strength.