The Password Strength Meter estimates how secure a password is and how long it would take an attacker to crack it — without ever sending the password anywhere. Everything is calculated locally in your browser, so the password you type never leaves your device.
How strength is calculated
The meter measures entropy, the number of bits of randomness in a password. Entropy rises with both length and the size of the character pool you draw from:
entropy (bits) = length × log₂(pool size)
A pool of lowercase letters is 26 symbols; adding uppercase, digits and punctuation grows it to roughly 95. A 12-character password from the full pool has about 79 bits of entropy — strong. The same 12 characters of only lowercase letters has about 56 bits — merely fair.
Crack-time estimate
The tool converts entropy into an estimated time to crack assuming a fast offline attacker making around 100 billion guesses per second. At that rate:
| Entropy | Roughly equals | Verdict |
|---|---|---|
| 28 bits | 8 lowercase letters | Weak — cracked in seconds |
| 40 bits | short mixed password | Fair |
| 60 bits | 10–12 mixed characters | Strong |
| 80 bits+ | 16+ mixed or 4-word passphrase | Very strong |
Stay safe
Use a unique password per account, prefer length over complexity (a four-word passphrase beats P@ss1!), and store them in a password manager. Every calculation here runs locally in your browser and nothing is sent to a server.