What this tool checks
This checker estimates a password's strength from entropy — the number of bits of randomness it represents — rather than from a simple checklist like "contains a number, contains a symbol." A checklist like that can be satisfied by Password1!, which any real cracking tool guesses in under a second despite ticking every box. Entropy, combined with pattern detection (keyboard sequences, repeated characters, known common passwords), gives a far more accurate approximation of how long a real attack would actually take.
Everything happens in your browser. There's no API call, no server, no logging — a design constraint stated as plainly as possible in the banner above the tool, because a "password checker" is exactly the kind of tool people are right to be suspicious of.
Why entropy, and not just length
Entropy is calculated as length multiplied by the base-2 logarithm of the character set size used. A 10-character password made only of lowercase letters draws from a set of 26 characters, giving roughly 47 bits. Add uppercase letters, digits, and symbols to those same 10 characters, and the set grows to about 95, pushing entropy to roughly 65 bits — a difference of nearly 20 bits, or over a million additional possible combinations. That's why "use a mix of character types" is genuinely useful advice, not just a policy checkbox: it directly multiplies the search space an attacker has to cover.
Length still dominates, though. Taking a lowercase-only password from 10 to 16 characters adds roughly 28 bits of entropy — more than widening the character set added. That's the reasoning behind the current shift toward long passphrases (four or five random dictionary words) rather than short, symbol-stuffed passwords that are hard to remember and barely stronger.
Why crack time is shown as a range, not a single number
The three scenarios shown — rate-limited online, offline with a slow hash, offline with a fast GPU hash — exist because "how long would it take to crack this password" doesn't have one answer. It all depends on how the password is stored and how it's attacked. A login form that locks out after five failed attempts (rate-limited online) is a completely different threat model from a leaked database of password hashes cracked offline on consumer GPU hardware, capable of billions of attempts per second against weakly hashed passwords. Showing all three keeps the estimate honest instead of giving a false sense of precision.
Common mistakes this tool catches
Keyboard sequences. qwerty123 and 1qaz2wsx look random at a glance when scanning a list of passwords, but they sit at the very top of every cracking dictionary, because they're trivial to type and therefore extremely common. The checker specifically looks for these keyboard-adjacency patterns, not just character variety.
Padding a weak base. Adding ! or 1 to the end of an otherwise weak password (password1!) barely moves the entropy needle, because the base word remains the dominant factor a dictionary attack targets first. This tool's common-password detection catches this case even after one or two characters have been tacked on.
Reusing a pattern that looks strong. A password can score well here — high entropy, no detected patterns — and still be a bad choice if it's reused across multiple accounts. This tool has no way of knowing that, which is why a password manager generating one unique password per site (like the generator built into this tool) matters more than any single password's strength score.