Password Strength Analyzer

How password strength is measured

The real strength of a password is the entropy an attacker has to burn to guess it — not whether it has "one uppercase, one number, one symbol." A 20-character passphrase of random words ("correct horse battery staple") has ~77 bits of entropy. An 8-character password with mixed case, a number, and a symbol ("P@ssw0rd!") has ~25 bits if you count the pool naively, but ~4 bits in practice because it is in every cracking dictionary in existence.

Our scoring model

We compute entropy as log2(pool_size) × length, then apply penalties for:

• Dictionary words — full words or stems in the top 10,000 English passwords list (RockYou-like).
• Keyboard walks — qwerty, asdfgh, 1qaz2wsx.
• Repeating / sequential characters — aaaa, 1234, abcd.
• Leetspeak substitutions — P@ssw0rd is password. Attackers know this.
• Dates and years — birthdates, 2024, 1985 are guessed first.

Crack-time estimates

The "time to crack" figures assume an attacker with modern GPU hardware performing an offline attack on a stolen hash. For bcrypt or Argon2, a single GPU does roughly 10,000 guesses/second. For unsalted SHA-256 (don't do this), a GPU does billions/second, and a rented 8-GPU cluster does trillions. We report both so you can see the difference a slow hash function makes.

Beyond strength: the enterprise password problem

Even a perfect password fails if it's reused, stored in plaintext, or emailed to a colleague. That's why this tool is a teaching aid, not a solution. At enterprise scale you need:

• SSO + MFA — passwords should authenticate humans to the identity provider only, not to every app.
• Secret scanning in CI — detect hardcoded passwords before they reach production. Security Factor 365 ships with 81 secret-detection patterns.
• Password policy enforcement — reject passwords in breach lists (HIBP k-Anonymity API), enforce minimum entropy, rotate on incident.