Check strength and estimate crack time
A password's real strength is best understood as how long it would take an attacker to guess. This auditor analyses a password's length and composition and estimates that time, turning an abstract "is this good?" into a concrete answer. The analysis runs entirely offline, so the password is never sent anywhere.
How to use it
- Type or paste a password to assess.
- Read the strength rating and estimated crack time.
- Strengthen it until the estimate is comfortably long.
What drives the estimate
- Length first — each extra character multiplies the work to crack it.
- Unpredictability — dictionary words and patterns are guessed quickly.
- Character variety helps, but far less than sheer length.
Questions people ask
Is it safe to enter a real password? The analysis is local and nothing is transmitted, but as good practice test something like your password rather than a live one.
Why does a "complex" short password rate poorly? It's short enough to brute-force regardless of symbols; length is what makes that impractical.