Password Strength Checker & Entropy Analyzer

Why "P@ssw0rd1!" Is Weak Despite Meeting Complexity Rules

Modern password security is about resistance to realistic attacks, not just checking if a password has uppercase, lowercase, numbers, and symbols. A password like P@ssw0rd1! meets most complexity requirements but is cracked in seconds by any password-cracking tool because it follows the most predictable pattern in human-chosen passwords: (capitalized common word) + (l33t substitution) + (number) + (special char). Attackers use rule-based attacks (hashcat's rockyou-30000.rule, OneRuleToRuleThemAll, etc.) that apply these exact transformations to wordlists. The first 100 million human-chosen "complex" passwords are tried in under a minute on a modern GPU. True strength comes from unpredictability, not complexity rules.

Entropy and Crack Time Tiers

Target: 60+ bits for low-stakes online accounts, 80+ bits for important accounts, 100+ bits for master passwords / crypto wallets. Practical examples: a random 12-char alphanumeric password = ~71 bits; a 6-word passphrase = ~77 bits; a 20-char random password with all character types = ~120 bits.

Why Length Beats Complexity

correct-horse-battery-staple (28 chars, all lowercase) provides ~44 bits of entropy from word selection alone — stronger than Tr0ub4dor&3 (12 chars with all character types, only ~28 bits). This is XKCD's famous insight: length compounds exponentially while complexity adds linearly. Each extra character doubles the search space (when added at the end of a random string); each extra character class only multiplies the per-character pool by a small factor (lowercase: 26 → adding numbers: 36 → adding uppercase: 62 → adding symbols: ~95). For passwords you must memorize, prefer length via random words. For passwords stored in a password manager, prefer length and full character set.

Patterns Attackers Check First

• Dictionary words: all of English, common Spanish/French/German, names, brand names — millions of guesses
• Common passwords: top 10,000 leaked passwords (rockyou.txt + breach lists) — tried in milliseconds
• L33t substitutions: p→@, o→0, a→4, e→3, i→1, s→$ — applied to dictionary words
• Capitalization patterns: first letter capital, last letter capital, alternating caps
• Append patterns: word + number (1-9999), word + year (1900-2030), word + symbol (! @ # $)
• Keyboard walks: qwerty, qaz2wsx, 1qaz2wsx, asdf, zxcv — patterns made by your fingers on the keyboard
• Sequences: 123456, abcdef, 1234abcd, 0987654321
• Repeated chars: aaa, 111, password111, 12121212
• Dates: 19xx-20xx years, MM/DD/YYYY, DDMMYYYY, common birthdays

This analyzer detects all of these and downgrades the rating accordingly — that's why P@ssw0rd1! rates weak even though it satisfies typical "3 of 4 character classes + 8 chars" policies.

Online vs Offline Attack Speeds

Online attacks (the attacker hits your login form) are rate-limited: 100 attempts/sec is generous; most services lock out after 5–10 failed attempts. For online attacks, even a weak password is "safe" — but you cannot assume your password will only face online attacks. Offline attacks (the attacker stole the database) can run at billions of guesses per second using GPU clusters: 10B/sec for fast hashes (SHA-256, MD5); 100B/sec for ASIC-optimized algorithms; ~100/sec for bcrypt-cost-12 (which is why bcrypt matters). You should always assume an offline attack will eventually happen (database breaches are common). Aim for entropy that resists 10B/sec offline attacks for at least the password's expected lifetime — that means 80+ bits.

HIBP Breach Check

Have I Been Pwned (haveibeenpwned.com, maintained by Troy Hunt) maintains a database of 850+ million passwords from public data breaches. The analyzer queries HIBP using k-anonymity: your browser hashes the password with SHA-1, sends only the first 5 chars of that hash, and HIBP returns all ~500 matching hash suffixes. Your browser compares locally. HIBP never sees your password or its full hash — they only know "someone somewhere checked a password starting with hash prefix XXXXX." If your password appears in any breach, replace it immediately even if it's strong on paper — attackers have it.

Beyond Passwords: 2FA, Passkeys, Password Managers

Even a perfectly strong password can be phished, keylogged, or leaked. Defense in depth:

• Password manager (1Password, Bitwarden, KeePassXC) — eliminates password reuse; you only memorize the master password
• 2FA via TOTP (our OTP Generator) — protects against credential stuffing from breaches
• Passkeys / WebAuthn — phishing-resistant; replaces passwords with public-key cryptography
• Unique password per service — limits the blast radius of any single breach
• Master password = a strong passphrase you actually memorize, used only as your password manager unlock