What this tool checks
This estimator measures the entropy of your password — a number, in bits, describing how unpredictable it is. It looks at which character types you used (lowercase, uppercase, digits, symbols) to work out the size of the character pool, then calculates entropy as length × log2(pool size). Higher entropy means a password is harder to guess by brute force.
It also shows an approximate crack time, assuming a fast offline attacker trying about 10 billion guesses per second.
Example
The password password1 uses only lowercase and digits over 9 characters, giving roughly 46 bits — crackable almost instantly by a determined attacker. A 16-character password mixing all four character types reaches about 100+ bits, which is effectively uncrackable by brute force with today’s hardware.
How to improve a weak password
- Add length. Every extra character multiplies the number of possibilities.
- Mix character types — add uppercase, numbers, and symbols.
- Avoid dictionary words, names, and dates. Attackers try these first.
- Prefer a passphrase — four or more random words are long, strong, and easier to remember.
- Generate one automatically with our Password Generator.
Limitations
- Entropy based only on character types overestimates strength for predictable passwords (like
Password123!). Real attackers use word lists and common patterns, so a “complex” but guessable password is weaker than its bit count suggests. - This tool does not check breach databases, so a password could score well here yet already be exposed from another site.
- Crack-time estimates depend heavily on how the password is stored by a service; they are illustrative, not exact.