Password Strength Checker

Yes. Unlimited use, no signup, no daily cap. The whole analysis runs in your browser. Kaspersky's checker is free but ad-supported and ships your password to a server; we don't.

No. The strength analysis is 100% browser-side. Your password text never leaves the page. We don't have an API call to send it anywhere even if we wanted to.

We compute base entropy from charset (lower / upper / digit / symbol) and length, then subtract penalties for weakness patterns (dictionary words, leet substitution, sequences, repeats, dates, common-list hits). Final score is 0-4 like zxcvbn, mapped to crack-time estimates at 4 attacker tiers.

Online (throttled, 100 guesses/sec, e.g. a login form with rate limiting), online (fast, 1M/sec, weak rate-limit), offline GPU (1T/sec, stolen hash + modern GPU), offline ASIC farm (100T/sec, nation-state hardware). Real-world attackers are usually tiers 2-3.

Leet substitution (0 for o, @ for a) is reversed by every cracker in milliseconds. The underlying word 'password' is in the top-10 most-common list. Real entropy is the same as 'password' itself, which is none.

Four to five unrelated random words like 'correct horse battery staple' (the famous xkcd example). Easy to remember, but the entropy comes from the word combinations, not the character set. 4 random words from a 7000-word list = ~52 bits, equivalent to ~9 random characters.

Depends on what's at stake. For a throw-away forum: yes. For your bank: 14+ with full diversity (upper, lower, digit, symbol). For a master password: 18-20 random chars or a 5-word passphrase. Length is the single biggest factor.

Yes. Each character class doubles the search space per character. A 12-char lowercase password has 26^12 = 95B possibilities. Same length with all 4 classes has 95^12 = 5.4e23. That's 10 trillion times more search space.

Yes. Crackers try the top 10K passwords first, then dictionary attacks with leet substitution, then keyboard patterns (qwerty, 1qaz2wsx), then names + dates. If your password matches any of those patterns it's cracked in under a second offline.

Yes. 1Password, Bitwarden, KeePass generate 24-char random passwords with full character diversity. You only need to remember one strong master password. The convenience-vs-security trade-off favors managers for 99% of people.