Tooltrusty

Password Strength & Crack-Time Calculator

Entropy, pattern detection and a realistic crack-time estimate — calculated on your device, never transmitted.

Nothing you type here is sent anywhere. The calculation runs in this page's JavaScript. As a habit, though, avoid typing a password you actually use into any website — test its structure instead, for example by changing a few characters.

—

0Length
0Character pool
0Entropy (bits)
—Guesses needed

Estimated time to crack

    Weaknesses found

      Generate a strong passphrase instead

      Runs in your browser. Everything you type or load here is processed locally by JavaScript on this page. Nothing is uploaded to Tooltrusty or to any third party.

      What the password Strength & Crack-Time Calculator does

      Password strength is really a question about search space: how many guesses would an attacker have to make before stumbling on yours? That number is usually expressed in bits of entropy, where each extra bit doubles the work. This calculator estimates the size of the character pool you have drawn from, multiplies by length to get a raw entropy figure, then subtracts for every predictable pattern it can detect — because a pattern an attacker can guess is search space that does not really exist.

      The pattern checks are the part that matters. Raw entropy maths treats Password2024! as a thirteen-character password drawn from a pool of 95 characters, worth about 85 bits. In reality it is a dictionary word, a capitalised first letter, a recent year and a trailing exclamation mark — a structure so common that cracking software generates it within the first few million guesses. This tool detects common words, letter-to-digit substitutions (4 for a, 0 for o), keyboard runs, sequential digits, repeated characters, years and the classic word-plus-digits shape, and reduces the estimate accordingly.

      Crack times are shown against four scenarios rather than one number, because the answer depends entirely on how the service you are protecting stores its passwords. Against a rate-limited login form, almost anything survives. Against an offline attack on a fast unsalted hash such as SHA-256, the same password can fall in minutes. You have no control over which case applies, which is the real argument for length: it is the only defence that works in every scenario.

      Rate assumptions used above were reviewed in September 2026 against published GPU benchmark figures. Hardware improves continually, so treat every duration as an order of magnitude rather than a prediction.

      How to use it

      1. Type a password — or better, a password with a few characters altered, so you are testing the structure rather than the real thing.
      2. Read the entropy figure and the weaknesses list. The weaknesses tell you more than the score does.
      3. Look at the crack time for the fast-hash scenario, since you cannot know how a given service stores passwords.
      4. If the result is poor, generate a passphrase below, or better, let a password manager create a random one.

      A worked example

      Four passwords, showing why length beats complexity:

      PasswordEffective entropyFast offline hash
      Summer2026!~30 bitsunder a second
      Tr0ub4dor&3~38 bitsa few seconds
      xK9#mQ2$vL4z~79 bitsroughly 2,000 years
      cedar-plover-quartz-lantern-mica~103 bitsfar longer than the universe has existed

      The last two are the interesting comparison. The random twelve-character string is genuinely hard to guess and genuinely hard to type or remember. The five-word passphrase is stronger, and you can memorise it after saying it twice. That is the case for passphrases in a nutshell — provided the words are chosen randomly by a machine, as they are here, and not picked by you, which is far more predictable than it feels.

      Frequently asked questions

      Is my password sent anywhere when I test it?

      No. Every calculation on this page runs in JavaScript in your browser and there is no server component to receive anything. Even so, the safe habit is never to type a password you actually use into any website — test a variant with a few characters changed instead.

      Why do the crack times differ so much between scenarios?

      Because they depend on how the service stores passwords, which you cannot see or control. A rate-limited login form allows perhaps 100 guesses a second. A leaked database of fast unsalted hashes allows billions a second on a single GPU. Same password, wildly different outcome — which is why length matters so much.

      Is a long passphrase really better than a short complex password?

      Usually, yes. Five randomly chosen words from a large list produce more entropy than twelve random mixed characters, and are far easier to remember and type. The critical word is randomly: words you choose yourself are much more predictable than words a machine picks.

      Does a strong password make my account safe?

      It removes one attack. It does nothing about phishing, malware, password reuse across sites, or a breach at the service itself. Use a password manager so every account gets a different random password, and turn on multi-factor authentication wherever it is offered — that protects you even when a password does leak.

      Last reviewed and updated: 6 September 2026. Figures and assumptions on this page are checked whenever the underlying guidance changes.