Password Entropy Checker

How this page is maintained

• Steps and copy are checked against the current tool behavior.
• Browser limits, file-size constraints, or compatibility gaps are documented when relevant.
• Unless a page explicitly says otherwise, files and text stay in the browser during processing.

The Illusion of "Strong" Passwords

For decades, we were told that P@$w0rd1! was a highly secure password because it satisfied the arbitrary rules of "one uppercase, one number, one symbol."

In reality, modern offline cracking rigs, firing off tens of billions of SHA-256 hashes per second, will shatter that password in milliseconds. They use massive dictionaries, combined with rulesets that automatically transpose a to @ and s to $.

Enter zxcvbn

Our Password Entropy Checker utilizes zxcvbn, an advanced password strength estimator originally developed by Dropbox. Rather than just checking off arbitrary boxes for symbols, it evaluates your password against:

1. Massive Dictionaries: It cross-references top 100k common passwords, English words, common names, and popular TV shows.
2. Predictable Patterns: It detects keyboard walks (like qwerty or asdfg), sequential data (123456), and repeated characters (aaaaa).
3. L33t Speak: It understands that you replaced an o with a 0.

Local Evaluation

The strength estimate is calculated in your browser; the password text is not included in site analytics events. The site separately collects usage information as described in the Privacy Policy. As a general security practice, do not enter a password you actively use into a website.

Key features

• True Local Evaluation: Avoid entering a password you actively use. This tool evaluates the text in your browser with the JavaScript zxcvbn library; site analytics records tool activity, not the password text.
• Dropbox zxcvbn Engine: Utilizes the industry-standard algorithm used by major tech companies to detect common words, names, and predictable patterns.
• Crack Time Estimates: Provides sobering, realistic timeframes for dedicated offline fast-hashing servers vs. online throttled attacks.
• Actionable Suggestions: Not just a generic "Weak" or "Strong" meter—receive intelligent suggestions on how to mutate your password to defeat dictionaries.

Frequently asked questions