password entropy and crack time
An 8-character password with a letter, a digit and a symbol looks strong at a glance, but the entropy calculation behind the analyzer measures the actual guessing space, and a built-in list of leaked passwords can knock that score down to zero even when the length looks fine.
`senha123` sits in the embedded leaked-password list, so the adjusted entropy drops to 1 bit even though the length-based raw entropy comes out to 41.4 bits; under an offline fast-hash attack (10 billion guesses per second), the estimated time is less than a tenth of a billionth of a second.
Twelve characters across three active character sets yield 71.5 raw bits, but the `2020` segment triggers the date-shape penalty (-6 bits), dropping the adjusted entropy to 65.5; it still closes at score 3 (strong), but the crack time under a single-GPU fast-hash attack falls to around 83 years, not the millennia the length alone would suggest.
Twenty-one lowercase characters and hyphens trigger no pattern penalty at all, so the adjusted entropy equals the raw value, 123.5 bits; even under the analyzer's most aggressive profile (a GPU cluster at 1 trillion guesses per second), the estimated time passes 10 to the 13th power seconds, roughly 317,000 years, a range the analyzer displays as "perpetual" instead of a practically meaningless number.
No. The whole analysis runs locally in the browser, in JavaScript. The password is never sent, stored, logged or shared with any external service.
Because the score does not just look at which character types were used, it also checks the whole password against an embedded list of the most leaked ones; on a match, the adjusted entropy drops to 1 bit and the score goes to 0 no matter how many character sets the password mixes.
The guessing speed per second: 100 attempts per hour for a throttled online login, 10 per second unthrottled, 10 thousand per second against a slow hash like bcrypt, 10 billion per second against a fast unsalted hash, and 1 trillion per second for a GPU cluster; the same password-and-hash pair can take anywhere from centuries to seconds depending on which of these five profiles describes the attacker.
Because the trailing year follows a recognizable date-like shape, and the analyzer applies a fixed 6-bit penalty whenever it detects that shape, since years are among the first things tested by rule-based password-guessing lists; length helps, but it does not cancel out the pattern penalty.
In the analyzer's example, yes: `correct-horse-battery`, using only lowercase letters and hyphens, reaches 123.5 bits because the 21-character length outweighs the character-set variety, and none of the pattern penalties trigger; a short password packed with symbols may have a larger per-position character set, but it loses on total combinations if it is too short.
Type a password above to see entropy, crack time and detected patterns.
The password is analyzed only in your browser. Nothing is sent, stored or logged on any server.