About Password Strength Visualizer
Most password strength meters return a single number and a colour. The Password Strength Visualizer breaks down what that number actually means: how many bits of entropy your password contains, which character classes contribute, what known weaknesses (sequences, repeats, dictionary words, dates) reduce the effective strength, and how long an attacker would take to crack it at five different attack rates — from a rate-limited online login to a multi-GPU offline cluster. Everything runs locally, your password never leaves the page, and the report is verbose enough to actually use as a password-policy reference.
- No uploads
- Browser-only
- Works offline
- 100% free
How it works
- 1
Type the password
Type or paste any password into the input. The analysis updates as you type, in your browser only.
- 2
Read the breakdown
See the entropy bits, character class counts, detected patterns, and time-to-crack at five attack rates from online-throttled to offline-extreme.
- 3
Iterate
Tweak the password and watch the bits climb. The 'Effective bits' figure penalises detected patterns; that's the number that actually matters.
Entropy is an upper bound — pattern detection is the reality check
Naive entropy is the textbook strength formula: length times the log-base-2 of the alphabet size. By that maths 'P@ssw0rd1' scores respectably — nine characters across four character classes. But entropy assumes every character was chosen independently at random, and a human-picked password almost never is. The instant a password contains a dictionary word, a name, a date, a keyboard run (qwerty, 1234), or a predictable substitution (@ for a, 0 for o), an attacker doesn't search the full random space — they search the tiny space of human habits first. That's why this tool reports an 'effective bits' figure that penalises detected patterns, and that's the number that actually predicts how long a guess takes.
Tools like Dropbox's zxcvbn formalised this: instead of counting character classes, they estimate guessability by matching against word lists, common passwords, keyboard patterns, dates and leetspeak, then computing how many guesses a realistic cracker would need. A pattern-aware estimate routinely rates a clever-looking password far weaker than its raw entropy — because the cracker is pattern-aware too.
Length beats complexity — and it isn't close
Every added character of true randomness multiplies the search space; swapping a letter for a symbol barely nudges it. A 16-character all-lowercase passphrase contains more entropy than an 8-character mix of upper, lower, digits and symbols — and it's far easier to remember and type. This is why modern guidance (NIST SP 800-63B) explicitly drops mandatory complexity rules in favour of length, and why a four- or five-word random passphrase is now the recommended human secret. Length is the lever with the best ratio of strength gained to memorability lost.
Watch a password being built in the meter and the asymmetry is obvious: adding a sixth random word sends the bits climbing far faster than sprinkling in punctuation. The catch the meter enforces: the words have to be random. 'correct horse battery staple' is strong because the words were drawn unpredictably; a memorable phrase from a song lyric is in every cracking wordlist and scores accordingly.
The one thing no strength meter can know: reuse
This is the most important sentence on the page: a meter rates guessability in isolation, so a password it calls 'very strong' is worthless if you've used it anywhere that was later breached. Attackers don't bother cracking reused credentials — they take username/password pairs dumped from one breach and replay them against banks, email and everything else (credential stuffing). Strength is irrelevant to that attack; uniqueness is the only defence. No analyser running locally can see whether a password already sits in a breach corpus, because checking would mean transmitting it — and a strength meter that uploads your password defeats its own purpose.
So treat a high score as necessary, not sufficient. The complete hygiene picture — unique-per-site passwords, a manager to hold them, and breach awareness — is laid out in password security in 2026. If you'd rather not invent strong strings by hand, generate them from a CSPRNG with the password generator and audit candidates here.
Why time-to-crack needs five rates, not one
A single 'time to crack' number is misleading because the attacker's speed depends entirely on how the password is stored — something the meter can't see. The same password might take centuries or minutes depending on the hash on the server. This tool therefore shows the estimate across a spread of attack rates, from a throttled online login to an offline GPU cluster, so you can read off the figure that matches your actual threat.
| Scenario | Approx. guesses/sec | Reads as |
|---|---|---|
| Online login, rate-limited | ~100 | Even weak passwords look slow — but lockouts can be bypassed |
| Online, no throttling | thousands | A misconfigured endpoint; weak passwords fall fast |
| Offline, slow hash (bcrypt/argon2) | thousands to millions | The defender did it right; strength buys real time |
| Offline, fast hash (MD5/SHA-1) | billions | The defender did it wrong; only length saves you |
| Offline, multi-GPU cluster, fast hash | 100 billion+ | Worst case — assume it for anything you can't afford to lose |
Pick the slowest rate that honestly matches the site. For a master password or anything high-value, plan against the right-hand columns — a breached database is cracked offline, on the attacker's terms.
Related guides
All guidesFrequently asked questions about Password Strength Visualizer
How is entropy calculated?
Length × log2(alphabet size). The alphabet size is determined by which character classes (lowercase, uppercase, digits, symbols) are present. Entropy gives an upper bound — a long password drawn from one class is much weaker than the bits suggest.
What does 'effective bits' mean?
Raw entropy minus penalties for detected patterns. Repeated characters, sequences (1234, abcd, qwer), dictionary words, dates and years all reduce effective entropy because attackers can encode them. The crack-time estimate uses effective bits, not raw.
Are the time-to-crack rates realistic?
The rates span from 100 guesses/sec (online with rate limiting) to 100 billion/sec (multi-GPU offline cluster on a fast hash like MD5). Real-world depends heavily on whether the password is hashed with bcrypt/argon2 (slow) or MD5/SHA1 (fast). Use the slowest rate that matches your threat model.
Why isn't there a hard pass/fail?
Strength is a continuum, not a yes/no. A password good enough for a forum sign-up is too weak for a banking master password. The detailed breakdown lets you make a contextual call instead of relying on a generic rating.
Privacy, offline use, browser support, and pricing questions are answered on the site-wide FAQ.