How is "time to crack" estimated?

It models an attacker guessing at some rate (billions per second for offline attacks on a stolen hash). The estimate is orders-of-magnitude, not a prophecy — relative comparisons between passwords are what matter.

Is a complex short password better than a long simple one?

Usually not. Length dominates: a four-word passphrase outruns a 9-character symbol soup because entropy grows with every added character of vocabulary, not only with symbol variety.

Does the tool store or transmit my password?

No — the analysis runs client-side and the input never leaves the page. Still, measuring a password on any shared machine carries some risk; prefer your own device.

Password strength analyser — Guide

Discover the strength of your password with this client-side-only password strength analyser and crack time estimation tool.

What it is and when to use it

Analyse a password's strength entirely in your browser — entropy, common-pattern checks and a crack-time estimate. Nothing is submitted anywhere, so it is safe to probe the passwords you actually use; the point is to see which weaknesses (length? reuse? predictable structure?) dominate your risk.

Estimates password strength and approximate cracking time, to judge whether a password is good enough.

How to use it

Enter the password to evaluate
Read the strength bar and estimated cracking time
Lengthen it or add character classes as suggested

Things that trip people up

The calculation runs entirely in your browser; the password is never sent anywhere

Questions people ask

How is "time to crack" estimated?: It models an attacker guessing at some rate (billions per second for offline attacks on a stolen hash). The estimate is orders-of-magnitude, not a prophecy — relative comparisons between passwords are what matter.
Is a complex short password better than a long simple one?: Usually not. Length dominates: a four-word passphrase outruns a 9-character symbol soup because entropy grows with every added character of vocabulary, not only with symbol variety.
Does the tool store or transmit my password?: No — the analysis runs client-side and the input never leaves the page. Still, measuring a password on any shared machine carries some risk; prefer your own device.

Next steps

Open the Password strength analyser tool

Spotted something wrong on this page? Tell us via Contact Us