Password Strength

The tool estimates entropy in bits from the character variety and length, then translates that into an approximate offline crack time. More bits means exponentially harder to guess.

Aim for at least 60 bits for important accounts, and more for high-value ones. Length contributes the most, so a long passphrase often beats a short complex password.

It is analysed on our server over HTTPS and never stored or logged. Even so, do not test a password you actively use on other sites — generate a fresh one.

Entropy in bits measures how many equally likely possibilities a password is drawn from. Each extra bit doubles the guessing effort, so higher entropy means an attacker must try exponentially more combinations.

It helps by enlarging the character set, but length matters far more. Extending a password by a few characters increases entropy more than sprinkling in a single symbol into a short one.

Attackers use word lists and common substitution rules, so predictable patterns such as a capital, a word and a year fall quickly regardless of length. Random or passphrase-based passwords resist these attacks.

It approximates how long an offline attacker with significant hardware would need to guess the password by brute force. It assumes the attacker has the hash, so real-world online attacks are usually far slower.