Check how strong your password is. Your password is never sent to our server - all analysis runs in your browser.
Enter a password to analyze its strength
Password entropy is calculated as length x log2(pool size), where pool size is the number of unique characters available based on which character classes are used. The crack time estimate assumes a fast offline attack at 10 billion guesses per second (typical for GPU-accelerated MD5 cracking) checking on average half the search space.
This is a theoretical estimate. Actual crack times depend on the hardware, the hashing algorithm used to store the password, and whether the password follows predictable patterns. A 12-character random password using all four character classes gives around 78 bits of entropy, which is very strong against brute force. Your password never leaves your browser. To check it against known data breaches, the tool sends only the first 5 characters of its SHA-1 hash to Have I Been Pwned (k-anonymity): the service answers with every breached hash that starts with those characters, and your browser looks for a match itself.