Password Audit & Policy Generator

A password strength checker analyses a password's randomness and resistance to attack without ever sending it to a server. It calculates entropy — a measure of unpredictability in bits — by looking at the size of the character pool (lowercase, uppercase, digits, symbols) and the password's length. More bits means an attacker must try exponentially more combinations.

Beyond raw entropy, a good checker detects structural weaknesses: keyboard walks like qwerty or 12345, leet speak substitutions like p@ssw0rd, and year patterns like 2024 — all of which dramatically reduce effective entropy even when character diversity looks adequate. The tool also estimates crack time at 1 billion guesses per second (a realistic offline attack rate) so you can see exactly how much time your password buys.

The table below shows how entropy bits translate to real-world crack times at 1 billion guesses per second — a conservative estimate for a modern GPU-based offline attack. Character set size has a major impact: adding symbols or uppercase letters increases the pool and therefore the entropy per character.

Character set impacts: digits only (10 chars) gives 3.32 bits per character; lowercase only (26) gives 4.7 bits; full printable ASCII (~95) gives 6.57 bits. Adding just one character type can add 1–2 bits per character — significant at scale.