Password Strength Meter
Entropy + pattern analysis — nothing sent
🔒 Nothing you type ever leaves this device. There's no form, no AJAX, no backend — this is plain JavaScript evaluating your password locally.
—
score out of 100
—
Length
—
Entropy (bits)
—
Character pool
—
Fast attacker (10¹⁰/s)
—
Offline KDF (10⁵/s)
—
Common pattern hits
What makes a password actually strong
Length matters more than complexity. \"ilovepizza.4ever\" beats \"Tr0ub4dor&3\" at the same total length because the former isn't in any leak dictionary. Use a passphrase: 4+ random uncommon words from a password manager's generator.
Related tools
Why "Tr0ub4dor&3" fails
- Attackers test l33t-substitutions on dictionary words first — o→0, e→3, a→@, s→$, t→7
- Such substitutions shrink the keyspace from random to structured
- Best defense: passphrases of 4+ uncommon words (e.g. \"correct horse battery staple\" style)
- Or: a password manager — generate 20+ char random per site
Crack times assume: fast attacker (10 billion guesses/sec, leaked-database crack with GPU rigs) vs slow attacker (100K guesses/sec with proper bcrypt/Argon2 — public-facing logins). Your real security depends on the server's KDF, not just password strength.