Password Strength Checker

Real-time Shannon entropy and multi-scenario brute-force resistance analyzer

Strength: -

Estimated Time to Crack Awaiting input

Worst-case offline attack using modern high-speed GPU clusters (100B guesses/sec)

Offline (Fast Hash)

MD5/SHA-256 (100B guesses/sec)

Hardware: 8x NVIDIA RTX 4090 GPU rig

Offline (Slow Hash)

bcrypt/Argon2 (10k guesses/sec)

Hardware: Workstation GPU / multi-core CPU

Online (Throttled)

Web login (100 attempts/hour)

Hardware: Standard PC / botnet proxy

About this checker

How password cracking actually works, explained in 4 simple steps:

Step 1 Wordlist Check (The Quick Guess)

Attackers test billions of known breached passwords first (like 123456, password, admin). If yours is on that list, it is cracked in milliseconds.

Step 2 Smart Variations & Patterns

Attackers automatically try common twists like adding digits (password123), symbols (admin!), repeats (aaaa), or keyboard walks (qwerty). This checker detects these patterns and reduces your score.

Step 3 Combination Math (Brute-Force)

If your password avoids common words, attackers must guess every possibility. We calculate the total combinations based on length and character types (uppercase, lowercase, numbers, symbols).

Step 4 Real-World Attack Scenarios

We divide the combinations by the speed of real attacker hardware across three realistic situations:

Offline Fast Hash (Worst Case)

A leaked database with weak encryption (MD5, SHA-256). An 8x NVIDIA RTX 4090 GPU cluster tries 100 billion guesses per second.

Offline Slow Hash (Well Protected)

A leaked database with strong security (bcrypt, Argon2). It forces attacker hardware to slow down to about 10,000 guesses per second.

Online Web Login (Live Defense)

An attacker guessing on a website login form. Defenses like rate limits, CAPTCHAs, and lockouts slow them to around 100 tries per hour.