Password strength meters usually reward the wrong things — a capital letter and an exclamation mark score well while the underlying word stays in every cracking dictionary. This checker calculates entropy from the actual character space, penalises common patterns, and estimates offline cracking time at realistic hardware speeds.
Nothing is transmitted or stored — analysis runs entirely in your browser. Even so, the safest habit is to test a similar password rather than the exact one you use.
Because the substitutions are the first thing every cracking tool tries. The dictionary word underneath is what matters, and rule-based attacks expand it in milliseconds.
From entropy divided by an assumed offline attack rate against a fast hash. It is a rough order of magnitude — a site using bcrypt is dramatically slower to attack than one using unsalted SHA-256.
Yes, when the words are chosen randomly. Four or five random dictionary words give high entropy and are far easier to remember. Choosing a memorable phrase yourself removes most of that advantage.
All free tools · Blog · About · Contact