# Password Strength Checker

> See how strong a password really is — entropy, time-to-crack, and a list of issues, all computed in your browser.

URL: https://uttir.com/password-strength-checker
Categories: security-tools
Privacy: Your password is analyzed locally in your browser. It is never sent to a server, logged, or stored anywhere.

## About

A strong password is the single biggest factor in whether an account gets compromised. This checker scores any password in real time using Shannon entropy, then layers on penalties for common patterns: keyboard sequences (qwerty, 1234), long repeats (aaaa, 1111), all-numeric or all-lowercase strings, and the most-leaked passwords on the internet.

The result is a 0–100 score, a strength bucket, the number of bits of entropy, a human-readable time-to-crack estimate at modern offline-attack speeds, and a list of specific issues if any were found. Every calculation runs in your browser — your password is never sent to a server.

## How to use

1. **Type or paste a password** — Use the show/hide eye to verify what you typed.
2. **Read the verdict** — Score, entropy, strength bucket, and a plain-English verdict appear as you type.
3. **Fix the issues** — If issues are listed, lengthen the password or add a missing character class.

## Examples

### A weak password

Lowercase letters, common word, 8 characters.

Input:

```
password
```

Output:

```
Very weak · ~6 bits effective · instantly crackable · common-password match
```

### A strong password

16 characters, mixed case, numbers, symbols.

Input:

```
T7$mK9p!qL2v#R4n
```

Output:

```
Very strong · ~104 bits · centuries to crack
```

## FAQ

### How is password strength measured?

Strength is the estimated bits of entropy — the log2 of the search space an attacker would have to try, adjusted for known-weak patterns. Above ~60 bits is good for most uses; above ~80 is very strong.

### Is my password sent to a server?

No. The analysis runs entirely in your browser using JavaScript. Open DevTools → Network and you will see no outbound requests while you type.

### What does “time to crack” mean?

It is an estimate at 10 billion guesses per second, the speed of a modern offline attack against a hashed database. Real-world speed depends on the hashing algorithm and attacker resources, but it is a useful ballpark.

### Why does length matter more than symbols?

Each extra character multiplies the search space by the size of the character pool. A 16-character lowercase password has more entropy than an 8-character mixed-case-symbols one, and is far easier to remember.

## Related tools

- [Password Generator](https://uttir.com/password-generator) — Create strong, random passwords with custom length and character sets — right in your browser.
- [Hash Generator](https://uttir.com/hash-generator) — Generate MD5, SHA-1, SHA-256, and SHA-512 hashes of any text instantly.
- [JWT Decoder](https://uttir.com/jwt-decoder) — Decode a JWT’s header and payload and check its expiration — without sending it anywhere.

---

For the full HTML page with the live tool, visit https://uttir.com/password-strength-checker.
This file is the markdown rendering at https://uttir.com/password-strength-checker.md. See https://uttir.com/llms.txt for a site-wide summary.