How is strength calculated?

Entropy analysis — character set × length. 12 chars from 95 printable ASCII: 79 bits. 16 chars same set: 105 bits. Plus zxcvbn-style pattern detection.

What's considered strong?

64+ bits resist casual brute-force. 80+ resist well-funded attackers. 128+ is the modern recommendation. 'Password1!' is ~20 bits — weak.

Does it check breach databases?

No — no API calls. For checking against breach lists use haveibeenpwned.com. This tool analyzes the password itself, not its history.

What about dictionary passwords?

Detected and flagged. Common passwords ('password', 'letmein', '123456') score near zero regardless of length. Substitutions (p@ssw0rd) are barely better.

Password Strength Analyzer

DevTools Surf

Example: Password Strength Analyzer

A worked example, rendered from real sample data. Sign in to run the tool on your own input.

Input

MyP@ssw0rd!2024

Output

Password:      M*************4 (masked)
Verdict:       Fair (2/4)
Length:        15 characters, 12 unique
Character set: 94 symbols (lowercase, uppercase, digits, symbols)
Raw entropy:   98.3 bits
Effective:     50.3 bits after pattern matching

Estimated time to crack:
  Online, rate limited     798.9 million years
  Online, no throttling    2.2 million years
  Offline, slow hash       2 thousand years
  Offline, fast hash       19 hours

Findings:
  [high] Contains the very common password "password"
      Leetspeak substitutions such as 4 for a or 0 for o are the first thing every cracking rule set tries, so they add almost nothing.
  [medium] Contains the year 2024
      Birthdays and years are a tiny keyspace and are usually findable from public profiles.

Suggestions:
  - Drop the recognisable word. Four unrelated random words beat one mangled word every time.
  - Remove the year or date — it is public information and it shrinks the keyspace to a few thousand options.
  - Use a password manager so every service gets a different high-entropy secret — reuse, not weakness, is what breaks most accounts.

About Password Strength Analyzer

Password Strength Analyzer preview - Security / Crypto tool

Analyze password strength with entropy and crack-time estimates. Part of the DevTools Surf developer suite. Browse more tools in the Security / Crypto collection.

Use Cases

Testing password policy enforcement before deploying to production
Educating users about password strength through visual feedback
Auditing existing password requirements against NIST guidelines
Comparing passphrase vs random character password effectiveness

Tips

Check entropy bits to understand mathematical password strength
Review crack-time estimates for different attack scenarios
Look for patterns like keyboard walks or common substitutions

Fun Facts

The zxcvbn algorithm, created by Dan Wheeler at Dropbox in 2012, estimates password strength by modeling real-world attack patterns.
The most common password worldwide in 2023 was still '123456,' used by over 4.5 million accounts according to NordPass research.
A truly random 12-character password using all character types has approximately 79 bits of entropy, requiring centuries to brute-force.

FAQ

How is strength calculated?: Entropy analysis — character set × length. 12 chars from 95 printable ASCII: 79 bits. 16 chars same set: 105 bits. Plus zxcvbn-style pattern detection.
What's considered strong?: 64+ bits resist casual brute-force. 80+ resist well-funded attackers. 128+ is the modern recommendation. 'Password1!' is ~20 bits — weak.
Does it check breach databases?: No — no API calls. For checking against breach lists use haveibeenpwned.com. This tool analyzes the password itself, not its history.
What about dictionary passwords?: Detected and flagged. Common passwords ('password', 'letmein', '123456') score near zero regardless of length. Substitutions (p@ssw0rd) are barely better.

Related Security / Crypto Tools

Hash Generator v2 HMAC Generator v2 JWT Encoder Bcrypt Hash Tester HMAC Generator TOTP / 2FA Generator SAML Response Decoder OAuth PKCE Generator