Loading…
Strength · Entropy · Crack time · Compliance · Developer
Start typing a password to see a live security analysis.
Tip: length beats complexity — a long random passphrase outlasts a short symbol-soup password.
Test password strength, calculate entropy, estimate crack time, validate against compliance standards and corporate identity policies, detect breached and predictable patterns, compare candidates, analyse developer credentials and generate strong replacements — all in real time, entirely in your browser. Your password is never uploaded, stored or logged.
A live 0-100 score and eight-band grade — Critical to Enterprise Grade — that updates with every keystroke, entirely in your browser.
See raw and pattern-adjusted entropy in bits, the full search space and the number of guesses needed to crack the password.
Estimated time to break the password across six attacker models — throttled online, fast GPU, cloud clusters and nation-state rigs.
Flags common/breached passwords, dictionary words, leet variants, keyboard walks, sequences, repeats, dates and personal information.
Validates against NIST 800-63B, OWASP ASVS, PCI DSS 4.0, ISO 27001, Active Directory, Entra ID and Google Workspace — pass / warn / fail.
Define your own organisation policy — length, classes, forbidden words and minimum score — and validate any password in real time.
Compare two passwords side by side: entropy difference, strength difference, crack-time gap and a clear recommendation.
Turns a weak password into strong alternatives — a fortified version, a random password, a memorable passphrase and an enterprise secret.
Generate strong passwords, passphrases, enterprise secrets, API keys and secure tokens with a CSPRNG — never pseudo-random.
Classify and assess API keys, JWT secrets, OAuth secrets, database URIs and cloud credentials, with rotation guidance.
Export a professional security report as PDF, JSON or TXT — without ever including the plaintext password.
Everything runs locally with Web Crypto. Your password is never sent to a server, stored, logged or cached.
Enter the password you want to test. It is analysed instantly in your browser — nothing is sent anywhere.
Watch the 0-100 score, grade, entropy and estimated crack time update as you type, with a colour-coded strength meter.
See exactly what is wrong — breached patterns, dictionary words, keyboard walks, personal data — and how to fix each one.
Confirm the password meets NIST, OWASP, PCI DSS, ISO 27001 and corporate identity policies, or define your own.
Apply the one-click improvement suggestions, or generate a strong password, passphrase or secret to replace it.
A strong password is one that an attacker cannot guess quickly, whether they are trying common passwords, dictionary words, or every possible combination. The single most important factor is length: each additional character multiplies the number of possibilities. A 16-character password is astronomically harder to crack than an 8-character one, even if the shorter one looks more “complex”.
After length comes unpredictability. A password built from a real word, a name, a date or a keyboard pattern has far less effective strength than its length suggests, because cracking tools try those structures first. The strongest passwords are either long random strings from a password manager, or passphrases of several unrelated words. This tester measures both the raw character-set entropy and the pattern-adjusted (effective) entropy, so you see real strength, not just apparent strength.
Entropy quantifies how unpredictable a password is, measured in bits. If a password is drawn randomly from a pool, its entropy is the length multiplied by the base-2 logarithm of the pool size. A 12-character password using lowercase, uppercase, digits and symbols (a pool of about 95) has roughly 12 × log₂(95) ≈ 79 bits — but only if it is truly random.
Each bit of entropy doubles the work an attacker must do. 50 bits means about a quadrillion guesses; 80 bits is beyond the reach of even cloud-scale attacks against a slow hash. As a rule of thumb, aim for 60+ bits for ordinary accounts, 80+ bits for important ones, and 128+ bits for cryptographic secrets. The tester reports entropy in bits and converts it into a concrete search space and crack time so the number means something.
Real attacks rarely start with brute force. Attackers begin with the cheapest guesses: lists of the most common passwords, then dictionaries of words, names and places, then “mangling rules” that apply predictable substitutions and append years or symbols. Only high-entropy, structureless passwords force them into true brute force, which is infeasible past about 80 bits.
Speed depends entirely on how the password is stored. Against a fast hash like MD5 or unsalted SHA-256, a single GPU tries tens of billions of guesses per second. Against a slow, salted hash like bcrypt or Argon2, the same GPU manages only tens of thousands. That is why this tester reports several attacker models — the difference between “instantly” and “centuries” is often the defender’s hashing choice, not just your password.
A passphrase is a sequence of several random, unrelated words — for example “violet-harbor-cactus-engine”. Because each word is chosen from a large list, four to six words deliver very high entropy (a 6-word diceware phrase is about 77 bits) while remaining far easier to type and remember than a random string of symbols.
The key is randomness: the words must be chosen by a generator, not picked by you, and they must not form a quotation or a sentence. “correct horse battery staple” is famous, which is exactly why you should not use it. Use the generator built into this tool to create a fresh passphrase, and the analyzer to confirm its strength.
Different frameworks prescribe different rules. NIST SP 800-63B, the most modern guidance, favours length and breach-screening over forced composition and rotation. OWASP ASVS requires a 12-character minimum and breach checks. PCI DSS 4.0 mandates at least 12 characters with letters and numbers for systems handling cardholder data. ISO/IEC 27001 expects quality passwords that are not based on personal data.
Identity platforms add their own policies: classic Active Directory enforces 3 of 4 character categories at 8+ characters, Microsoft Entra ID adds a global banned-password list, and Google Workspace enforces a strength gate. The compliance auditor in this tool checks a password against all of these simultaneously and shows exactly which requirements pass, warn or fail — useful for both end users and administrators.
You cannot remember a unique, random, 20-character password for every account — and you should not try. A password manager generates and stores them for you, so each site gets a distinct credential and a breach of one never cascades. Your only job is to protect the manager with one very strong master passphrase and MFA.
Multi-factor authentication is the highest-value control after unique passwords: even a leaked password is useless without the second factor. Prefer phishing-resistant factors such as passkeys (WebAuthn) or hardware security keys over SMS codes. In a zero-trust architecture, the password is just one signal among many, and every request is continuously verified — but strong, unique credentials remain the foundation everything else builds on.
Tries every possible character combination in order of length. Guaranteed to succeed eventually, but infeasible beyond ~80 bits of entropy.
Defence: Maximise length and randomness; store with a slow, salted hash so each guess is expensive.
Guesses common words, names, places and previously breached passwords before resorting to brute force.
Defence: Avoid real words and known passwords; use random strings or random multi-word passphrases.
Combines dictionary words with mangling rules — leet substitutions, appended years and symbols, capitalisation.
Defence: Don’t rely on predictable substitutions; “P@ssw0rd2024!” is a textbook hybrid target.
Replays username/password pairs leaked from one breach against many other sites at scale.
Defence: Never reuse passwords; enable MFA so a leaked password alone is not enough.
Tries a handful of very common passwords across many accounts to dodge per-account lockouts.
Defence: Block common passwords, monitor for distributed failures, and require MFA.
Looks up precomputed hash→password pairs to reverse unsalted hashes instantly.
Defence: Salting (and slow hashing) makes every stored hash unique and defeats precomputation.
Tricks the user into entering their password on a fake site or form — no cracking required.
Defence: Use a password manager (it won’t autofill on the wrong domain) and phishing-resistant passkeys.
Captures keystrokes or memory on a compromised device to steal passwords directly.
Defence: Keep devices patched, use hardware-backed MFA, and prefer passkeys that never expose a secret.
Check the strength of your everyday passwords and replace weak or reused ones before attackers do.
Validate passwords against corporate identity policies (AD, Entra ID, Workspace) and compliance standards before onboarding.
Show users in real time why “Summer2024!” is weak and how a passphrase beats forced complexity.
Assess API keys, JWT signing secrets and database credentials for sufficient entropy and rotation hygiene.
Produce evidence that credentials meet NIST 800-63B or PCI DSS 4.0 with downloadable, shareable reports.
Prototype and test a custom password policy against real candidates before rolling it out organisation-wide.
Length beats complexity: a 16-character passphrase of unrelated words outlasts an 8-character “P@ssw0rd!”.
Never reuse a password. A breach of one site becomes a breach of all your accounts through credential stuffing.
Use a password manager to generate and store a unique random password for every account.
Turn on multi-factor authentication everywhere — it protects you even if a password leaks.
Avoid anything an attacker can research: names, birthdays, pets, employers, sports teams and favourite words.
Don’t rely on predictable substitutions (a→@, o→0, s→$). Cracking tools expand them automatically.
Stop forced periodic rotation; modern guidance (NIST) says only change passwords on evidence of compromise.
For machine secrets and API keys, aim for at least 128 bits of entropy from a CSPRNG.
A measure of unpredictability in bits. Each extra bit doubles the number of guesses needed to crack a password.
Entropy after penalising predictable patterns (dictionary words, sequences, repeats), used for realistic strength scoring.
Trying every possible combination of characters until the password is found.
Guessing using lists of common words, names and previously breached passwords rather than every combination.
Reusing username/password pairs leaked from one breach to log into other sites where people reuse passwords.
Trying a few very common passwords against many accounts to avoid lockouts that target a single account.
A precomputed lookup of hash→password pairs; defeated by salting, which makes every stored hash unique.
Random data mixed into a password before hashing so identical passwords produce different hashes.
A one-way transformation used to store passwords so the plaintext cannot be recovered from the database.
A cryptographically secure pseudo-random number generator — required for generating real secrets and passwords.
A password made of several unrelated words; long and memorable with high entropy.
Multi-/two-factor authentication — an extra verification step beyond the password (app code, passkey, hardware key).
A pattern that follows adjacent keys such as “qwerty” or “1qaz2wsx” — trivially guessed.
A security model that never implicitly trusts a credential and continuously verifies every access request.