MMaxTools

Password Strength Checker

Analyze password strength: entropy, character classes and crack-time estimates.

The Password Strength Checker analyzes any password and scores it on a five-level scale using length, character classes and estimated entropy — with a realistic time-to-crack estimate and a checklist of what to improve.

Strength is math: password entropy = length × log₂(character pool), and every added bit doubles the attacker's work. An 8-character lowercase password holds ~38 bits and falls in seconds to offline cracking; 14 mixed characters push past 80 bits and into the centuries.

The checker also flags the failures math ignores — common passwords like 'password123' and repeated runs like 'aaa' that appear in breach lists regardless of length. Use it with the Password Generator to see what 'strong' actually looks like.

How to use the Password Strength Checker

  1. Type a password (or a candidate you are considering).
  2. Read the strength label and the colored bar.
  3. Check the entropy figure and time-to-crack estimate.
  4. Review the checklist of satisfied criteria.
  5. Improve the weak points and re-check.

Frequently asked questions

What is password entropy?

A measure of unpredictability in bits: pool size per character × length. Each bit doubles the guesses needed. 60+ bits resists offline attacks; short or single-class passwords rarely reach even 40.

How accurate is the time-to-crack estimate?

It assumes an offline attacker trying ~1 billion guesses per second — the realistic worst case for hashed passwords. Online attacks are far slower, but breach lists make common passwords instant regardless.

What makes a password strong?

Length above everything: 12–16+ characters beats complexity alone. Mixing classes helps, but a long passphrase ('correct horse battery staple') is both stronger and easier to remember than a short symbol salad.