Password Strength
Frequently Asked Questions
Everything you need to know about password strength
What is password entropy?
Entropy measures in bits how unpredictable a password is. It is calculated as length multiplied by the base-2 logarithm of the size of the character set used. The more bits, the more attempts needed to guess it: each extra bit doubles the number of possible combinations. A password above 60-70 bits is generally considered strong.
How is the crack time estimated?
The crack time is a theoretical estimate based on a brute-force attack trying about 10 billion combinations per second (an offline scenario with fast hashes). We divide the total number of possible combinations by this speed. It is only an indication: a dictionary attack or leaked data can be much faster if the password is common.
Is my password sent anywhere?
No, absolutely not. All the analysis happens entirely in your browser via JavaScript: the password is never transmitted to a server nor saved. You can verify this by disconnecting from the internet, the tool still works. In general, never paste your real passwords into online tools you do not trust.
What is the entropy of a password?
It is the measure in bits of how unpredictable the password is: it depends on the length and on how many different characters are used. Every extra bit doubles the attempts needed to guess it.
How is the time to force it estimated?
By assuming a brute force attack of about ten billion attempts a second, the scenario of someone who has stolen the hashes and is working locally. It is an order of magnitude, not a guarantee.
Is the password I type sent anywhere?
No. The analysis happens in the browser and nothing is transmitted: you can disconnect and the tool keeps working. It is still a good rule not to paste the passwords you actually use here.