Password Strength
Rough entropy and crack-time estimate for a password, with feedback.
Most password advice measures the wrong thing. Complexity rules — one capital, one digit, one symbol — produce passwords that are hard for humans to remember and easy for cracking rigs to guess, because everyone satisfies them the same predictable way. Length and unpredictability are what actually cost an attacker time.
How to use it
- Type a password into the box — it is never sent anywhere.
- Read the strength assessment and the reasoning behind it.
- Try a long passphrase of unrelated words and compare it against a short password full of substitutions.
What to take away
P@ssw0rd! is not a strong password
Cracking tools apply exactly these substitutions automatically. Replacing a with @ and o with 0 adds effectively nothing, because the rule is in every wordlist mangling ruleset.
Length beats complexity
Four unrelated words are far harder to crack than eight mixed characters, and far easier to remember. This is why passphrases have replaced complexity rules in modern guidance.
Reuse is the real risk
A perfect password used in two places is only as safe as the weaker site. Breach data means attackers do not need to crack anything — they just replay what leaked elsewhere.
Frequently asked questions
Does this tool send my password anywhere?
No. The check runs entirely in your browser and nothing is transmitted or stored. That said, the correct instinct is never to type a real password into any website — try a variation instead.
How long should a password be?
Current guidance favours a minimum of 12–14 characters, and longer for anything valuable. Once you are past that, uniqueness and multi-factor authentication matter more than adding another symbol.
Are password managers safe?
Far safer than the alternative, which is reuse. One strong master password plus a manager gives every account a unique random secret, and that removes the single biggest cause of account takeover.
Where this fits in the course
This security tool pairs with Path 06 — Cryptography — see all 26 learning paths.
It runs entirely in your browser: nothing is uploaded, no account is needed, and it is free.
Related
- Password Policy Checker — Test a password against a configurable length/complexity policy, rule by rule.
- Password Cracking Lab — Four hashed passwords, one wordlist. See exactly which ones fall to a dictionary attack and which survive it — and why.
- Entropy Calculator — Shannon entropy of any text — a genuine static-analysis signal for spotting packed or encrypted data.
- Hash Generator — SHA-1, SHA-256, SHA-384, SHA-512 of any text, via the browser's crypto engine.