Loading…
Score password entropy, crack time, and improvement tips. Use for auditing; for creating passwords use password-generator. Input: password text (never stored). Returns score + feedback. 100% client-side.
Password Strength Analyser is loading — interactive editor will appear here. Use examples below to try instantly once loaded.
Press ? for keyboard shortcuts
Analyses password strength in real-time as you type, providing entropy calculations, estimated crack time, character pool analysis, and actionable feedback tips. Displays a visual strength meter for intuitive assessment.
Understanding password strength goes beyond simple 'weak/medium/strong' labels. This tool provides the underlying entropy mathematics and practical crack-time estimates so developers and users can make informed decisions about password security.
This tool is part of the DevStackIO platform — a collection of free online developer tools from DevStackIO. Browse more free developer resources on DevStackIO.
Developers designing password policies, security-conscious users evaluating their passwords, and anyone building registration or login systems.
Type or paste a password in the input field — analysis updates in real time
Observe the visual strength meter indicating overall strength level
Review the entropy calculation showing the bits of entropy (higher is better)
Check the character pool analysis showing counts of uppercase, lowercase, digits, and symbols
Read the feedback tips for suggestions to improve the password
Password: 'password123' → Low entropy, fast crack time, feedback: add symbols and uppercasePassword: 'Tr0ub4dor&3' → Moderate entropy, moderate crack time, feedback: consider longer lengthPassword: 'correcthorsebatterystaple' → High entropy due to length, despite lower character diversityHow is entropy calculated?
Using the formula log2(charset_size^length), which estimates the number of possible combinations.
What does 'bits of entropy' mean?
Each bit doubles the number of possible combinations; 80+ bits is considered strong.
Why is my long passphrase rated highly? Length is the most important factor
long passwords have exponentially more combinations.
Is the crack time estimate realistic?
It's a lower bound assuming offline brute-force; real-world attacks may be faster or slower.
Authoritative specifications, standards, and in-depth reading for Password Strength Analyser.
Tips
Generate MD5, SHA-1, SHA-256, SHA-384, and SHA-512 hashes for text. Copy or compare instantly.
Generate time-based OTP codes from authenticator secret. Use for 2FA testing; for random tokens use token-generator. Input: Base32 secret. Returns 6-digit code + QR. 100% client-side.
Decode SSL certificates (subject/expiry/chain). Use for debugging certs. Input: PEM text ≤10MB. Returns parsed fields. 100% client-side.
Build Content-Security-Policy headers. Use for XSS hardening. Input: directive options. Returns policy string. 100% client-side.
Compute MD5/SHA-256/SHA-512 checksums for files to verify integrity. Use for files; for text strings use hash-generator. Input: file ≤10MB. Returns hex digests. 100% client-side, files never uploaded.
Infer JSON Schema from sample JSON for validation. Use when authoring schemas; for validating instances use json-validator. Input: JSON ≤10MB. Returns JSON Schema draft. 100% client-side.
Hash passwords with bcrypt (cost-configurable) and verify. Use for password storage; for fast checksums use hash-generator, for keyed MACs use hmac-generator. Input: password text. Returns bcrypt hash. 100% client-side.
Generate sortable ULIDs (time-ordered IDs). Use when ordering matters; for random UUIDs use uuid-generator, for tokens use token-generator. Input: count option. Returns ULID strings. 100% client-side.