Password Crack Time Estimator

A green bar saying strong password tells you nothing useful. Type a password here and you get estimated entropy in bits plus average crack time across five concrete scenarios, from a throttled online attack at ten guesses per second up to an adversary running a trillion guesses per second, with bcrypt and GPU cracking in between. It is built for comparing candidates before you commit to one.

The maths is the classic search space one: length times the base-2 log of the character set in use, minus 4 bits for three repeated characters and 6 bits for obvious runs like 1234, qwer or asdf. The time shown already halves that space, since an attacker wins halfway through on average. What the heuristic lacks, despite the name, is the common-password dictionary the real zxcvbn library ships: that is why P@ssw0rd scores 53 bits and almost four GPU days here, when in practice it falls in seconds.

Read the ranking, not the absolute number. Comparing two of your own candidates is the honest use of this page. If the password contains a dictionary word, a team name, a birth year or the old letter-to-digit swap, knock several zeros off the estimate yourself. A long passphrase of unrelated words beats a sprinkling of symbols. The value you type never leaves the browser, but the field shows it in plain text on screen, so avoid the habit of typing the password you actually use.