Password Strength Checker — Honest Crack-Time Estimate
🔒 100% computed in your browser. Your password never leaves this device — there is no server, no analytics, no network requests.
Copied — the text contains only statistics, never your password.
Estimate — based on offline attack at 10 billion guesses/sec.
⚠️ A password that has already been leaked is useless, no matter how long it is.
How this estimate works
Entropy = password length × log₂(character-set size). The set is built from the character classes your password actually uses: lowercase (26), uppercase (26), digits (10), symbols (~32). Crack time = 2entropy ÷ 10,000,000,000 guesses per second — the speed of a realistic offline brute-force attack against a stolen password hash.
Penalty rules (applied before the estimate)
- Common password. If it matches a built-in list of widely-used passwords
(e.g.
password123,qwerty,123456), it is reported as crackable instantly — attackers try these in the first seconds of every dictionary attack. - Keyboard walk. A run of 4+ characters along a standard QWERTY row
(forward or reverse, e.g.
qwer) counts as 20 bits — one of roughly a million known patterns — instead of its raw brute-force value. - Repeated pattern. The password is reduced to its smallest repeating unit
(
abcabc→abc×2); entropy is computed on the unit. A single repeated character is the extreme case of this rule.
These penalties are heuristics, shown explicitly so you can judge them. Real attackers are smarter than any formula — treat the number as an optimistic upper bound.
FAQ
How does PasswordLab estimate crack time?
We compute entropy as password length × log₂(character-set size), counting only the character classes your password actually uses (lowercase 26, uppercase 26, digits 10, symbols ~32). Crack time is 2^entropy ÷ 10 billion guesses/sec — a realistic offline brute-force rate. Common passwords, keyboard walks and repeated patterns get explicit penalties.
Is it safe to type my real password here?
Yes. PasswordLab has no backend and makes zero network requests. Everything runs in JavaScript in your browser, and the share button copies only statistics — never the password itself.
What does "bits of entropy" mean?
Bits of entropy measure the size of the search space: each bit doubles the guesses needed. 40 bits ≈ a trillion guesses, 60 bits ≈ a quintillion. A random 12-character password using all four character classes has about 79 bits.
Why is my long password rated weak?
Length alone is not enough. If a password appears in public leaked-password lists, attackers try it within seconds — it is effectively cracked instantly no matter how long it is. Keyboard walks and repeated patterns shrink the real search space far below the naive math too.
What makes a strong password?
Length plus unpredictability: 12+ characters from several classes, or a random 4–6 word passphrase. Avoid anything published, quoted, or patterned. A password manager that generates random passwords is the most reliable approach.
Is this estimate a guarantee?
No — it is an estimate from a fixed model (offline attack, 10 billion guesses/sec, documented penalties only). Real attackers use smarter targeted methods, so treat it as an optimistic upper bound, not a promise.