How to use the Password Strength Checker
Type or paste your password. The strength score, entropy, and time-to-crack update instantly. No data is sent anywhere — all analysis runs in your browser.
What is it?
Password strength is measured by entropy — the number of possible combinations based on length and character variety. Entropy is measured in bits: each additional bit doubles the search space. A 72-bit entropy password is considered strong for most purposes.
Time-to-crack assumes an attacker with a modern GPU running 10 billion guesses per second (offline hash cracking scenario). Online attacks are much slower due to rate limiting — but offline attacks against leaked hashes are the real threat.
Benefits
Verify data integrity instantly
Hash comparison confirms whether a file, API response, or downloaded binary has been altered in transit or at rest — without storing the original content.
Authenticate requests and webhooks
HMAC signatures prove a request came from a trusted source and was not modified in transit — the mechanism behind Stripe, GitHub, and AWS webhook security.
Protect sensitive data at rest
AES-256 encryption makes stored content unreadable to anyone without the key — even if your database, S3 bucket, or file system is fully compromised.
Generate credentials that meet security standards
Cryptographically random output from the Web Crypto API satisfies NIST entropy requirements — unlike predictable Math.random()-based alternatives.
Frequently asked questions
What is password entropy?
Entropy measures unpredictability in bits. A password from an alphabet of 94 printable ASCII characters with 16 characters has log2(94^16) ≈ 105 bits of entropy. More entropy = exponentially more guesses required.
Is my password sent anywhere?
No. All analysis happens in JavaScript in your browser. Your password is never transmitted.