Password Strength Tester (entropy + crack time)

What 'entropy' means for passwords

Entropy measures unpredictability in bits. A password with 30 bits of entropy needs ~2³⁰ ≈ 1 billion guesses on average to crack. 70+ bits is generally considered strong; 80+ is excellent.

Formula: entropy = length × log₂(charset_size). 'abcdefgh' (8 chars, lowercase only) = 8 × log₂(26) ≈ 37.6 bits. 'aA1!aaaa' (8 chars, all charsets) = 8 × log₂(95) ≈ 52.6 bits — but the crack time is much worse than 52 bits would suggest because 'aaaa' is a common pattern.

Why crack times vary so much

Offline GPU: a leaked password hash being attacked offline. Modern GPUs can guess 10⁹+ MD5 hashes per second; bcrypt hashes only 10⁴-10⁵/s. The estimate here uses GPU-fast hash assumption.

Online fast: an attacker hammering a login API directly. Most APIs have some rate limit; 1000 attempts/sec is a high-end estimate for a poorly-defended endpoint.

Online slow: a properly defended endpoint with strict rate limits, account lockouts, and CAPTCHA. 100 attempts/sec is generous; many systems allow only 5-10/min.

These estimates ignore real-world factors like dictionary attacks (which find common passwords much faster than brute force) and password reuse (cracking one site's leak helps crack others).

What makes a strong password

Length over complexity: a 16-char passphrase like 'correct horse battery staple' is stronger than a tortured 8-char like 'P@ssw0rd!'. The XKCD insight from 2011 still holds: 4 random words give ~44 bits of entropy.

Avoid patterns: dates, names, '123', 'qwer', repeated characters all reduce real entropy below the formula value. Attack tools include extensive 'rule-based' transformations (e.g., 'password' → 'P@ssw0rd!').

Use a password manager: humans pick patterns; managers don't. Bitwarden, 1Password, KeePass generate truly random passwords per site, with 16+ characters across all charsets. The only password you need to remember is the master password — and that one should be a long memorable passphrase.