Question 1

What is password entropy?

Accepted Answer

Password entropy measures unpredictability using Shannon's information theory formula: bits = length × log₂(charset size). For example, a 12-character password using all 94 printable ASCII characters has about 78.8 bits of entropy. A higher bit count means exponentially more possible combinations, making brute-force attacks far slower. Security experts generally recommend at least 60 bits for everyday accounts and 80+ bits for high-value targets like banking or email.

Question 2

How is crack time estimated?

Accepted Answer

Crack time is estimated by mapping your password's entropy against the number of guesses a modern GPU-based brute-force attack can attempt per second — typically billions to trillions. The tool maps entropy thresholds to human-readable time spans such as 'a few hours' or 'centuries.' This is an order-of-magnitude estimate designed to give you a practical sense of real-world risk rather than a precise cryptographic prediction, since actual attack speed varies by hardware and method.

Question 3

Is my password sent to a server?

Accepted Answer

No, your password is never sent anywhere. All analysis runs entirely in your browser as client-side JavaScript — the same technology your browser uses to compute hashes and run local logic. There are no network requests, no API calls, no analytics logging, and no server-side storage of any kind. You can disconnect from the internet and the tool will still work correctly, since everything executes locally on your device.

Question 4

Why does a long password with only lowercase letters score lower than a shorter mixed password?

Accepted Answer

Entropy depends on both length and charset size. A lowercase-only password uses a 26-character alphabet, while a mixed password uses up to 90 characters. Adding character types multiplies the search space far more than adding a few extra characters.

Question 5

What entropy level is considered strong?

Accepted Answer

Below 28 bits is very weak and crackable in seconds or less with standard hardware. Passwords in the 28–60-bit range are weak to fair and vulnerable to determined attackers using modern GPUs. The 60–128-bit range is strong and suitable for most everyday accounts. Above 128 bits is considered very strong and currently resistant to all known brute-force attacks, including those using distributed or specialized computing resources.

Question 6

Does a high score mean my password is safe to use everywhere?

Accepted Answer

Strength is only one factor. A strong but reused password is still vulnerable if another site is breached. Always use a unique password for every account and consider a password manager to keep track of them.

Question 7

What should I do if my password is weak?

Accepted Answer

Use our free Password Generator to create a cryptographically secure password tailored to your preferred length and character set. Aim for at least 16 characters combining uppercase letters, lowercase letters, numbers, and symbols — this yields roughly 100+ bits of entropy. For critical accounts like email and banking, consider using a passphrase of four or more random words, which can be both strong and memorable while still scoring well above the recommended 60-bit threshold.

Password Strength Checker

Why check your password strength?

How to check your password strength

Frequently Asked Questions