Password strength checker

How it works

The estimate assumes every character was picked at random from the set the password draws on. That set, the pool, is the sum of the classes in use: 26 for lowercase, 26 for uppercase, 10 for digits, 32 for punctuation and one more for a space. Entropy is the length multiplied by the base-two logarithm of the pool size, which is the same as length × log(pool) ÷ log(2). The bar shows the result against 128 bits and the labels use fixed thresholds printed with the result: under 28 very weak, under 36 weak, under 60 fair, under 80 strong, 80 and above very strong. This is an estimate, not a measurement and not a prediction of how long a guess would take.

Worked example

For Tr0ub4dor&3 the length is 11 and all four classes are present, so the pool is 26 + 26 + 10 + 32 = 94. The base-two logarithm of 94 is 6.5546 bits per character, and 11 × 6.5546 = 72.10 bits, which the tool labels strong because it is between 60 and 80.

Questions and answers