PassGuard

Password Strength Checker

Type a password — see an entropy-based strength score, character set used, and a rough offline crack-time.

Password

Very weak0 bits

Length: 0
Character set: 0
Estimated offline crack time: Instant

Estimated against a fast offline GPU attack (~10¹⁰ guesses/sec). Never enter real passwords on untrusted sites — this runs in your browser, but make it a habit.

What you entered

Password length: 0Character set: 0

1
Character set size from what's used
lowercase + uppercase + digits + symbols detected= 0 possible characters
2
Entropy = length × log2(charset size)
0 × log2(1)= 0.0 bits
3
Guesses to try half the keyspace
2^0.0 ÷ 2= 5.00e-1 guesses
4
Time at ~10¹⁰ guesses/sec (fast offline GPU)
guesses ÷ 10,000,000,000= Instant

Result

Estimated crack time: Instant

With 0 possible characters across 0 characters, this password has 0.0 bits of entropy — rated "Very weak," with an estimated offline crack time of Instant.

Entropy and offline crack time for common password patterns

Every row below is the exact output this checker produces for that password. Entropy is length multiplied by log2 of the character set size, where lowercase only counts 26 characters, adding uppercase and digits counts 62, and adding symbols counts 94. Crack time assumes a fast offline GPU attack at roughly 10 billion guesses per second against half the keyspace.

Example password	Length	Entropy (bits)	Rating	Estimated offline crack time
123456	6	19.9	Very weak	Instant
qwerty	6	28.2	Weak	Instant
password	8	37.6	Reasonable	10.4 seconds
P@ssw0rd	8	52.4	Reasonable	3.5 days
Password1	9	53.6	Reasonable	7.8 days
Tr0ub4dor&3	11	72.1	Strong	8.0e+3 years
X7#kL2$mQ9pR	12	78.7	Strong	7.5e+5 years
correcthorsebatterystaple	25	117.5	Strong	3.8e+17 years
j4K!vR8@wZ2%nQ6&tB9#	20	131.1	Very strong	4.6e+21 years
correct horse battery staple	28	164.0	Very strong	3.8e+31 years

Read these as an upper bound, not a promise. The estimate is charset-based: it counts which character classes appear but does not detect dictionary words, names, dates or keyboard runs, so password and qwerty are cracked from a wordlist in well under the time shown here. The crack time also assumes a fast hash such as MD5 or unsalted SHA-256; a password stored with bcrypt, scrypt or Argon2 resists guessing thousands of times longer, while a password reused on a breached site is compromised no matter how many bits it has. Compare the 8-character symbol soup with the 25-character all-lowercase phrase to see why length beats complexity. Never type a password you actually use into any strength checker, including this one; test the pattern, not the real thing.

Length beats complexity

A 16-character lowercase phrase beats an 8-character random soup with symbols. Length adds bits of entropy exponentially; character variety adds them linearly.

Frequently asked questions

My password is 'Tr0ub4dor&3' with mixed case, numbers, and symbols — is it strong?

Not as strong as you'd think. Despite the complexity, it's only 11 characters. A simple 4-word passphrase like 'correct horse battery staple' (25 characters) has significantly more entropy and is easier to remember.

What is password entropy?

Entropy measures unpredictability in bits. Each bit doubles the possible combinations an attacker must try. A truly random 8-character password using uppercase, lowercase, digits, and symbols has about 52 bits of entropy — roughly 4.5 quadrillion possibilities.

How long would it take to crack my password?

It depends on the attacker's hardware and the hashing algorithm. Against a fast hash like MD5, a modern GPU can try 50+ billion passwords per second. Against bcrypt, the same GPU might manage only 50,000/sec — a million-fold difference.

Does adding a single symbol at the end really help?

Barely. Attackers try common patterns like appending '!' or '1' first. A symbol embedded randomly within a longer string adds meaningful entropy, but length and true randomness matter far more than any single character choice.

How is this different from the hash generator?

This tool evaluates password strength by estimating entropy and crack time without hashing anything. The SHA-256 hash generator computes a cryptographic fingerprint of any text — useful for data integrity, not password evaluation.