IPv4 to IPv6 Converter
Convert an IPv4 address into every IPv6 form that carries it, and back.
Password Strength Checker
Estimate how long a password would survive, and see exactly what weakens it.
Nothing is transmitted, stored or logged. Even so, typing a real password into any web page is a habit worth avoiding — test a close variant instead.
Quick Tool Overview
The Password Strength Checker estimates entropy, subtracts what real cracking tools exploit — word lists, leet spellings, keyboard runs, years and common shapes — and gives crack times across four attack scenarios.
- What it does
- Estimates password strength and explains it
- You give it
- A password
- You get back
- Entropy, crack times and specific weaknesses
- Best for
- Understanding why a password is weak, not just that it is
About the Password Strength Checker
A green bar that says "strong" is useless if it cannot say why. This estimates the entropy of a password, then subtracts what a real cracking tool would exploit: words from the standard lists, leet substitutions of those words, keyboard runs, repeats, years and the Capital-word-then-digits shape that most passwords take.
The crack time is given for four scenarios, because they differ by a factor of a trillion. An online form with rate limiting, an online form without it, an offline attack on a bcrypt hash, and an offline attack on a fast hash like MD5 — which is what a breach actually hands an attacker. A password that survives centuries in the first scenario can fall in minutes in the last.
Key features of the Password Strength Checker
Four attack scenarios
Rate-limited online, unthrottled online, offline bcrypt and offline fast hash — figures that differ by a factor of a trillion.
Sees through leet substitution
P@ssw0rd is checked against the word list after the substitutions are undone, because that is exactly what a cracking tool does.
Named weaknesses
Keyboard runs, repeats, embedded years and the Capital-word-then-digits shape are each called out, so you know what to change.
Entropy after discounting
The bit count reflects predictability rather than just the character pool, which is what makes it meaningful.
Nothing is transmitted
The check runs entirely in your browser and nothing is sent, stored or logged.
How to use the Password Strength Checker
-
1
Type a password
It stays in your browser; nothing is transmitted or stored.
-
2
Read the entropy
Measured in bits, after the predictable patterns have been discounted.
-
3
Check the four crack times
The offline fast-hash figure is the one that matters after a breach.
-
4
Read the specific findings
Each weakness is named, so you know what to change rather than guessing.
Frequently asked questions
The check runs entirely in your browser and nothing is sent or stored. That said, the habit of typing real passwords into web pages is a bad one, so testing a close variant is wiser.
Because every cracking dictionary contains the leet-substituted spellings of common words. Replacing a with @ and o with 0 adds essentially nothing, and the tool applies the same substitutions before checking its word list.
Length, and unpredictability. Four or five random words beat a short string of symbols on both counts and are far easier to type. Best of all is a password manager generating something you never see.
The offline fast-hash one. It assumes the attacker has the hash and the site stored it badly, which is exactly the situation after a breach — and the one you have no control over.
Reviews of the Password Strength Checker
What people who use the Password Strength Checker think of it. Reviews come from visitors and are posted as written.
No ratings yet
Yours would be the first.
- 5 0 reviews rated 5 stars
- 4 0 reviews rated 4 stars
- 3 0 reviews rated 3 stars
- 2 0 reviews rated 2 stars
- 1 0 reviews rated 1 star
0 reviews
Newest first
No reviews yet
Be the first to rate the Password Strength Checker. It takes half a minute and no account.
Write the first reviewMore developer tools
My User Agent
See your own user agent string and what a server can tell from it.
Unicode Code Point Lookup
Inspect any character: code point, block, category, UTF-8 bytes and escapes.
HTML to JSX
Convert HTML into valid JSX, with every attribute renamed correctly.
Box Shadow Generator
Build layered box shadows visually, with a live preview.
Test Credit Card Generator
Generate Luhn-valid test card numbers that no processor will ever charge.
Keyframes Animation Generator
Build CSS keyframe animations and watch them run as you edit.
JavaScript Keycode Tester
Press any key and see event.key, event.code and the modifier state.