Password Strength & Entropy Auditor
Live entropy, crack-time, and pattern audit — 100% client-side
Entropy in Bits
Entropy measures how unpredictable a password is, calculated from the size of its character pool (lowercase, uppercase, digits, symbols) and its length.
Crack-Time Estimates
See how long an average brute-force attack would take across a range of hardware, from a rate-limited login form to a massive offline GPU array.
Pattern Detection
Sequential runs (abc, 321), keyboard-adjacent runs (qwerty), and repeated characters (aaa) all sharply reduce real-world guessability, even when raw entropy looks high.
Private By Design
Paste is disabled and every calculation runs locally in your browser's JavaScript engine. Nothing you type is ever sent to our servers.
Understanding Password Entropy
Guidance like NIST SP 800-63B shifted the industry's focus away from forced complexity rules (mandatory symbols, frequent rotation) and toward overall length and unpredictability. This auditor estimates entropy the same way: it looks at which character pools your password draws from (lowercase, uppercase, digits, symbols) and multiplies that pool's log2() by the password's length. A longer password from a smaller pool can easily beat a short one from a larger pool.
Raw entropy alone can be misleading, though: Qwerty123! uses all four character pools but is still highly guessable because it's built entirely from a keyboard-row pattern and a sequential number run. That's why this tool subtracts a penalty for every detected weak pattern before estimating crack time, so the final strength meter reflects real-world guessability rather than just the math on paper.
Key Takeaways
- Length beats complexity: Adding characters increases entropy multiplicatively, while adding a single new character class only adds a modest amount per character.
- Patterns undercut entropy: Sequential runs, keyboard-adjacent runs, and repeated characters are the first things real-world cracking dictionaries try, regardless of raw bit count.
- Hardware matters: The same password can be effectively uncrackable against a rate-limited login form yet fall in seconds to an offline GPU array against a leaked hash database.
- Privacy: All calculations run locally using native JavaScript; nothing you type here is ever transmitted, stored, or logged. This tool is educational and does not guarantee absolute security.