Password Strength Checker: Entropy, Crack Time + Custom Policy

Password Strength Checker

Entropy bits · crack-time estimates · pattern detection · custom policy

Your password is never sent anywhere — all checking happens in your browser, and the password is never included in any copied or printed output.

Never type a real production password into any website — use a sample of the same shape

Enter a password to begin

Define Your Own Password Policy

Set your organisation's rules — the password is validated against these in addition to the general strength score.

e.g. your company name, current year, product names

Analysis

Type a password to see its entropy in bits, estimated crack times at different attack speeds, any weak patterns detected and targeted suggestions to improve it

Reports contain the strength summary and policy checklist only — the password itself is deliberately excluded.

Entropy assumes an attacker who knows the character set but not the password, and crack times assume plain brute force over that space — a real attacker uses wordlists, leaked-password databases and rule-based mangling, so a "human-looking" password falls far faster than its raw entropy suggests. The bundled common-password and pattern checks are a small illustrative sample, not a full breach corpus, so passing them is not proof of safety. Estimates are illustrative, never a guarantee. Modern guidance (NIST SP 800-63B) favours long passphrases and breach blocklists over forced composition rules; use a password manager and unique passwords per site.

Password Strength Checker: Entropy Bits, Crack Time and Your Own Organisational Policy

Most password checkers give you a coloured bar and a vague label. This tool measures actual entropy in bits from your password’s real character-set pool and length, then applies penalties for the patterns that matter most in practice, common passwords, repeated characters, sequential runs and keyboard-adjacent walks. It shows estimated crack time at four clearly labelled attack speeds, from a throttled online login form all the way up to an offline GPU cluster, so the number actually means something. it also includes something most checkers skip entirely: a custom policy builder where you set your own organisation’s rules, minimum length, digit and symbol counts, banned words like your company name and get a clear pass or fail against each one. Everything runs in your browser. Your password is never sent anywhere, and it is deliberately excluded from any copied or printed report.

How to Use

Step 1: Type a password to test

  • Type into the Password field. Tap the eye icon to toggle showing or hiding the characters as you type. Since this box is exactly the kind of thing you shouldn’t paste a real production password into on any website, use a sample password of the same shape and length instead, the analysis works identically either way and the tool reminds you of this directly under the field.
  • As you type, the strength meter above the results fills in live, from Very Weak up to Very Strong, based on the password’s effective entropy after all penalties are applied.

Step 2: Read the analysis

  • The results panel shows the password’s entropy in bits, both raw (before any penalties) and effective (after them), estimated crack time at four labelled attack speeds, online throttled guessing at 10 per second, online unthrottled at 1,000 per second, an offline slow hash like bcrypt at 10,000 per second and an offline GPU cluster at 100 billion per second, plus a list of any specific weaknesses detected, common password matches, repeated characters, sequential runs, keyboard-adjacent patterns, digits-only or letters-only composition and embedded dictionary words, each with a plain-language explanation of why it matters.
  • Below the findings, targeted suggestions tell you specifically what to change, not just that the password is weak.

Step 3: Build your own organisational policy, if you need one

  • Open “Define Your Own Password Policy.”
  • Set your Min length, Min digits and Min symbols requirements.
  • Tick whichever composition rules your organisation actually requires: an uppercase letter, a lowercase letter and disallowing common dictionary words.
  • Enter any Banned substrings, comma separated, things like your company name, the current year or product names that shouldn’t appear in a password at your organisation.
  • Tick “Enable this policy” to turn on validation. Once enabled, the results panel shows a clear pass or fail against every single rule you’ve set, in addition to the general entropy-based strength score above it.

Step 4: Export a report, if you need one

  • Use Print Report or Copy Report to get the strength summary and policy checklist. The password itself is deliberately left out of both, by design, since a report is meant to be shared or filed without ever containing the actual secret it’s evaluating.

Key Features

  • Mathematical entropy calculation, length multiplied by log base 2 of the actual character-set pool used, not a rough guess
  • Crack time estimates at four clearly labelled attack speeds, from throttled online guessing to an offline GPU cluster, so the number reflects a real-world scenario
  • Pattern detection for common passwords, repeated characters, sequential runs, keyboard-adjacent walks, digits-only or letters-only composition, and embedded dictionary words, each with its own entropy penalty
  • Custom organisational policy builder, set your own minimum length, digit and symbol counts, case requirements and banned substrings, with a clear pass/fail per rule
  • 100% client-side. Your password is never sent to any server, ever
  • Password deliberately excluded from exports. Printed and copied reports contain the strength summary and policy checklist only, never the password itself
  • Live strength meter that updates as you type .

Formula / Logic Used

Character-Set Pool

Pool=26 (if lowercase)+26 (if uppercase)+10 (if digits)+33 (if symbols)+1 (if space)Pool = 26\ (\text{if lowercase}) + 26\ (\text{if uppercase}) + 10\ (\text{if digits}) + 33\ (\text{if symbols}) + 1\ (\text{if space})

Only the character types actually present in your password count toward the pool, so a password using just lowercase letters and digits draws from a pool of 36, not the full 95.

Raw Entropy

H=L×log⁡2(Pool)H = L \times \log_2(Pool)

Where LL is the password’s length. This is the standard NIST SP 800-63 Appendix A style entropy estimate.

Effective Entropy (After Penalties)

Heffective=H−∑(Penalties)H_{effective} = H – \sum(\text{Penalties})

Detected weaknesses each subtract a fixed number of bits, roughly 8 bits for a repeated-character run, 8 bits for a sequential run, 10 bits for a keyboard-adjacent walk, and 6 bits for an embedded dictionary word, reflecting how much of the theoretical randomness that pattern actually gives away to an attacker who checks for it first. An exact match against a known common password overrides this entirely, dropping effective entropy down to roughly the log base 2 of that password’s rank in the list, since an attacker simply tries the most common passwords first.

Average Guesses and Crack Time

Guesses=2(Heffective−1),Time=GuessesAttack RateGuesses = 2^{(H_{effective} - 1)}, \qquad Time = \frac{Guesses}{Attack\ Rate}

The average number of guesses needed is taken as half the total search space, since on average an attacker finds the password partway through, not at the very end of every possibility.

Who Should Use This Tool

Anyone who wants to genuinely understand how strong a password is, rather than trust a coloured bar, before using it on an important account. Also useful for IT and security staff at a small organisation who need to define and communicate a custom password policy and for diploma and B.Tech Computer Science students learning entropy and brute-force concepts as part of a security or cryptography course.

Frequently Asked Questions (FAQs)

1. How is password entropy actually calculated?

Entropy in bits equals the password’s length multiplied by log base 2 of the character-set pool it actually draws from, lowercase, uppercase, digits and symbols each add to that pool only if they’re genuinely present. This tool calculates that raw figure, then subtracts specific penalties for detected weak patterns to get a more realistic effective entropy.

2. Why does this tool show four different crack times instead of just one?

A real attacker’s speed varies enormously depending on the scenario, a login form that throttles attempts might allow only 10 guesses a second, while an offline attacker with a leaked, unsalted hash database and a GPU cluster can try 100 billion a second. Showing all four labelled speeds together gives a far more honest picture than a single generic number.

3. Why does a long, real-looking password sometimes still score lower than expected?

Raw entropy only measures the theoretical size of the search space assuming an attacker has to try every combination blind. Real attackers use wordlists, leaked-password databases and pattern-aware guessing rules first, so a password that looks complex but follows a common human pattern falls much faster than its raw entropy alone would suggest, which is exactly why this tool applies separate penalties for those patterns.

4. How do I set up a password policy for my own organisation?

Open “Define Your Own Password Policy,” set your minimum length, digit and symbol requirements, tick the case rules you need, add any banned words like your company name in the substrings field, and tick “Enable this policy.” Every password you test afterward is checked against your exact rules with a clear pass or fail per rule.

5. Is it safe to type a real password into this tool to test it?

The analysis runs entirely in your browser and nothing is ever sent to a server, but as a matter of general safety habit, you should still avoid typing a real, currently-in-use password into any website, including this one. Test a sample password of the same length and character mix instead. The result will be identical, since the tool only ever looks at structure, never at whether the specific password is one you actually use.

Related Tools

Read More>>>

Scroll to Top