Password Strength
Measure password entropy, detect reuse against known breach corpora (k-anonymity Have I Been Pwned lookup), and get concrete advice. Nothing leaves your browser in plaintext.
About password analysis
This tool rates a password's strength by entropy, character class coverage and common-pattern detection, and optionally checks it against a public breach corpus using k-anonymity (only the first 5 hex chars of the SHA-1 hash are sent). The full password never leaves your browser.
Entropy
Entropy is a measure of unpredictability in bits. Every character class (lowercase, uppercase, digits, symbols) expands the search space attackers must brute-force. As rough targets:
- Below 30 bits: very weak, trivially crackable by a modern GPU.
- 30 to 50 bits: weak, only acceptable against very slow hashes.
- 50 to 70 bits: moderate, reasonable for low-value accounts.
- 70 bits and more: strong from 70, excellent from 90. A random password of about 11 characters from all four classes reaches 70 bits, about 14 characters reach 90 bits.
How it works
The strength estimate is computed entirely in your browser. The tool looks at which character classes the password contains: lowercase letters (a pool of 26), uppercase letters (26), digits (10) and everything else (counted as 32 symbols). The sizes of the classes present are added up to a pool size, and the entropy is the password length multiplied by the base-2 logarithm of that pool, rounded to one decimal. A 10 character password drawn from a pool of 94 therefore scores about 65.5 bits.
The strength label is derived from that number: below 30 bits is very weak, below 50 weak, below 70 moderate, below 90 strong and anything above that excellent. The character class badges show which pools were counted.
This formula assumes that every character was chosen independently and uniformly at random. Human-chosen passwords rarely are, so the figure is an upper bound on what an attacker faces. The separate suggestions list checks for patterns that the formula cannot see: fewer than 12 characters, fewer than three character classes, a single repeated character, three identical characters in a row, and a handful of very common substrings such as 123, qwer or password. Those findings do not lower the bit count, so a password can receive a high score and still carry warnings.
The optional breach check
If the breach check is enabled (it is on by default and can be switched off with the checkbox), the browser computes the SHA-1 hash of the password and sends only the first five hexadecimal characters of that hash to a public breach-lookup service. The service returns every known hash suffix that shares this prefix, and the comparison with the remaining characters happens locally in your browser. The password itself and the full hash are not transmitted. The request asks the service to pad its response so its size does not reveal how many entries matched. The lookup runs only for passwords of four or more characters. The service does receive your IP address, as any web request does.
How to read the results
- Strength label and bits: the entropy estimate described above, together with the password length.
- Breach check: either "not found", a count of how often the password appears in known breach data, or a note that the service could not be reached. A count above zero means the password is public knowledge to attackers and should not be used anywhere, regardless of its bit score.
- Suggestions: concrete weaknesses the tool detected. An empty list does not make a password safe, it only means none of these simple checks matched.
Length matters more than complexity
Every additional character multiplies the search space by the pool size, while adding a symbol class only raises the pool from, say, 62 to 94. Going from 8 to 12 characters adds far more than swapping a letter for a symbol. Predictable substitutions such as a to @ are part of every cracking dictionary and add almost nothing.
Passphrases and password managers
A passphrase of four or more unrelated words is long, easy to remember and hard to guess, provided the words are chosen randomly and not from a quote or a song. Note that the bit figure shown for a passphrase treats it as random characters and so overstates its strength: the real search space is the number of possible words raised to the number of words. For everyday accounts the most reliable approach is a password manager that generates a unique random password per site, protected by one strong passphrase and multi-factor authentication.
Examples
All inputs below are invented and must not be reused. Never type a password you currently use for an important account into any web page you cannot audit, and prefer a similar password with the same structure.
Example 1: aaaaaaaaaaaa
Twelve lowercase letters score about 56.4 bits and land in the moderate range, but the suggestions flag a single repeated character. The score is misleading here because the formula cannot know the password has no randomness. Treat any pattern warning as more important than the number.
Example 2: Summer2024!
Eleven characters from all four classes score about 72.1 bits, which the tool labels strong, and the suggestions note that it is shorter than 12 characters. In practice a season, a year and a trailing symbol is one of the first guesses attackers try, so the real strength is far lower than the figure suggests. If the breach check finds it, discard it.
Example 3: kalamar-bridge-onion-rustle
Four unrelated words joined by hyphens give a very high computed value because the tool treats the 27 characters as random. The honest assessment is lower, since each word comes from a limited vocabulary, but a randomly chosen four word phrase is still far stronger than any short complex password and remains easy to type.
Common problems and how to fix them
- "Could not reach" appears in the breach section. The lookup service did not answer, for example because of a network filter or a browser extension blocking the request. The strength estimate is unaffected. Allow the request or try again later.
- No breach check runs. Check that the box is ticked and that the password has at least four characters.
- A long password is rated low. Few character classes lower the pool. Add length first, then variety.
- A strong password was found in a breach. Stop using it everywhere and change it on every site where it was used. A high score does not protect a password that has already leaked.