Password Strength Analyzer

Entropy is calculated as: bits = length × log₂(charset_size). For a 16-char password using all character types (uppercase + lowercase + digits + symbols = ~95 chars), entropy ≈ 16 × 6.57 = 105 bits. Higher entropy means more combinations an attacker must try.

NIST SP 800-63B recommends: minimum 8 characters, checking against known compromised passwords, no mandatory complexity rules (but length is paramount), and no forced periodic changes. A long passphrase like 'correct-horse-battery-staple' can be both NIST compliant and strong.

Crack time is estimated assuming an offline attack with modern GPU rigs (~100 billion hashes/sec for MD5). It's entropy-based: combinations = 2^entropy_bits, time = combinations / hashrate. Modern bcrypt/Argon2 hashing slows this dramatically — the estimate reflects worst-case unprotected storage.

No. All analysis runs entirely in your browser via JavaScript. Your password is never transmitted to any server and never stored anywhere.

This analyzer grades a password you provide. A generator creates a new random password. For maximum security: generate a random password, then analyze it here to confirm it meets your bar before using it.