Password Strength Checker

The calculator starts with log2(charset size) x length after detecting character classes. It also reduces the estimate for exact repeated units and known predictable sequences or common-password variants. The result remains an upper-bound model for passwords chosen uniformly from the inferred pool, and it can overestimate human-created passwords.

There is no universal safe entropy threshold for an account. The displayed bands are local heuristics based on an assumed 10 billion guesses per second and the uniform-pool model. Real risk depends on password uniqueness, storage cost, rate limits, phishing, malware, recovery, and multi-factor authentication.

A passphrase of four to six random words from a large list (like the EFF's 7,776-word Diceware list) typically beats a short random password on both entropy and memorability. Four random words yields about 51 bits, six yields about 77 bits. The key word is random: a phrase you invent yourself is far less secure than one generated by a tool.

No. A strong password helps if a site's database is breached, but it cannot stop phishing, malware, or reuse of a password you already leaked elsewhere. Pair every important account with a second factor (a TOTP app, a hardware security key, or a passkey) so a stolen password alone is not enough to get in.

The current implementation analyzes the field in browser memory and does not persist it through this component. Even so, do not paste a live password into a third-party web page. Browser extensions, compromised scripts, device malware, screenshots, and memory inspection are outside this calculator's control. Use a generated sample with the same length and character classes instead.