How is the strength estimated?

The tester estimates entropy from the character set used (lowercase, uppercase, digits, symbols) and the length, then derives an offline crack time assuming an attacker can make 10 billion guesses per second against a fast hash. It also flags very common passwords and trivial patterns.

What is a good password?

Aim for 60 bits of entropy or more — typically 12 or more characters mixing upper and lower case letters, numbers and symbols, with no dictionary words or repeats. A long random passphrase scores well.

What do the five rating levels mean?

The score runs 0 to 4: a common password or under 28 bits scores 0, under 40 bits scores 1, under 60 bits scores 2, under 80 bits scores 3, and 80 bits or more scores 4 (very strong).

Why is my long password still rated weak?

The tester checks against a list of common passwords and flags trivial patterns. A long but common or predictable password is downgraded, because real attackers try known passwords and patterns long before brute-forcing.

How does it calculate crack time?

It takes 2^entropy ÷ 2 as the average number of guesses, then divides by 10 billion guesses per second — a realistic rate for an offline attacker with GPUs against a fast hash. The result is shown in seconds up to years.

Is a passphrase better than a complex password?

Often yes. Four or five random words give high entropy from sheer length and are far easier to remember than a short string of symbols, while still scoring strongly here.

Is my password sent anywhere?

No. The test runs entirely in your browser using JavaScript. Your password is never uploaded, stored, logged or transmitted — it never leaves your device.

What is the Password Strength Tester?

Free password strength tester. Type any password to see its entropy in bits, an estimated offline crack time, a strength rating, and specific suggestions to make it stronger. Runs entirely in your browser — nothing is uploaded and your password never leaves your device. It runs free in your browser on Gera Tools, with nothing uploaded.

Password Strength Tester

Name: Password Strength Tester
Creator: Gera Tools
License: https://creativecommons.org/licenses/by/4.0/

Get one useful tool a week

Like this tool? Enter your email and we'll send you one genuinely useful Gera tool a week — plus a link to come back to this one. No spam, one-click unsubscribe any time.

Password strength tester

Type a password and instantly see how strong it really is: a five-level strength meter, the entropy in bits, and an estimated offline crack time. Unlike a simple “8 characters with a number” rule, this measures the actual size of the search space an attacker faces and flags passwords that look strong but are easy to guess.

How it works

The tester computes entropy from the character pool and length, estimates an offline crack time, then assigns a 0–4 score with safeguards for weak patterns:

pool    = 26 (a–z) + 26 (A–Z) + 10 (0–9) + 33 (symbols), only the types present
entropy = length × log2(pool)   bits
guesses = 2^entropy ÷ 2
crack   = guesses ÷ 10,000,000,000 guesses/sec   (offline, fast hash)

A common-password match or under 28 bits forces a score of 0. Otherwise the bands are under 40 bits = 1, under 60 = 2, under 80 = 3, and 80+ = 4. Specific suggestions tell you which lever — length, variety, uniqueness — will help most.

Worked examples

The password Summer2024 (10 chars, pool 62 — upper, lower, digits):

Entropy: 10 × log2(62) ≈ 59.5 bits → score 2 (Fair)
It also resembles a common seasonal-year pattern, so the tester downgrades it and suggests adding length and a symbol. A version like Summer2024!kq8 would reach 80+ bits and score 4.

Password	Pool	Entropy	Score
123456	10	19.9 bits	0 — Very weak
iloveyou	26	37.6 bits	0 — Common password
Summer2024	62	59.5 bits	2 — Fair
Summer2024!kq8	95	97.7 bits	4 — Very strong
correct horse battery staple	27 (a–z + space)	136 bits	4 — Very strong

Why some “strong-looking” passwords still score low

The tester checks against a list of the most common breached passwords and applies pattern penalties. If a password matches or closely resembles an entry on that list — even if it contains uppercase, digits, and symbols — it scores 0. This is not a bug: attackers prioritise known passwords and predictable patterns (seasonal words + year, keyboard walks, common substitutions like @ for a) long before exhausting the full search space.

The practical implication: a 12-character password constructed from a random character generator is far stronger in practice than a 15-character one built from a word you know, even if the entropy calculator gives them similar scores.

Common patterns that score lower than expected

Summer2024! — seasonal word + year + symbol: classic pattern
qwerty123 — keyboard walk
P@ssw0rd — common substitution; appears in every cracking wordlist
Your name + birth year or pet name + number
Any single dictionary word, regardless of case or symbol appended

The best practice is a password manager generating long, genuinely random strings. If you need something memorable, a diceware passphrase (four or five random words chosen by rolling dice from a large wordlist) gives strong entropy from length while remaining human-readable.

Everything runs in your browser and your password never leaves your device.