Password Strength Calculator
Rate a password by its entropy — length and character variety — and estimate how long it would take to crack by brute force.
How it works
pool = 26 (lower) + 26 (upper) + 10 (digits) + 33 (symbols), by classes present · entropy bits = length × log₂(pool) · average crack time = 2^(entropy−1) ÷ 10¹⁰ guesses per second
Password strength is measured as entropy — the number of bits of randomness, which is the length multiplied by the log base 2 of the size of the character pool. Each character class you use enlarges that pool: lowercase adds 26 possibilities, uppercase another 26, digits 10, and symbols about 33, so mixing classes and, above all, adding length raise entropy fast. The crack-time estimate assumes an offline attacker trying 10 billion guesses a second and needing, on average, half the total combinations. The crucial caveat: this maths assumes every character is chosen at random. A real password built from a dictionary word, a name or a keyboard pattern is guessed far sooner than its raw entropy suggests, because attackers try those first.
Worked example
"Password123" is 11 characters using lowercase, uppercase and digits — a pool of 26 + 26 + 10 = 62 symbols. Its entropy is 11 × log₂(62) ≈ 11 × 5.95 ≈ 65 bits, which rates as Strong, and brute force would nominally take decades. But because it is a common word plus "123", a real cracker using a wordlist would break it in seconds — a reminder that entropy is an upper bound, not a promise.
Sources: Password strength — Wikipedia
Frequently asked questions
What makes a password strong?
Length first, then variety. Every extra character multiplies the number of guesses needed, so a long passphrase beats a short complex one. Mixing uppercase, lowercase, digits and symbols enlarges the per-character pool, but adding length is the single most effective move — aim for 12+ characters, or a random passphrase of several words.
Is my password sent anywhere?
No. The scoring runs entirely in your browser with no network request, so nothing you type is transmitted, logged or stored. Even so, avoid pasting a password you actively use anywhere you do not fully trust.
Why might a "Strong" password still be weak?
Because entropy assumes randomness. "Password123" scores well on length and variety but is a dictionary word plus an obvious suffix, so attackers guess it almost immediately using wordlists and rules. Real strength comes from unpredictability — a random generator or a passphrase of unrelated words — not from a familiar word dressed up with a capital and a number.
Related calculators
This is an educational estimate based on character variety and length; it does not detect dictionary words, reuse or breaches. Use a password manager and unique passwords for real accounts.