What Makes a Strong Password? Entropy and Crack Time Explained

Most “make your password stronger” advice is wrong, or at least dated. Add a capital letter, throw in a number, tack on an exclamation mark — and you end up with Password1!, which any cracking rig guesses in under a second. The Password Strength Checker measures what actually matters, and it does it without your password ever leaving the page.

Entropy, not “complexity”

Strength comes down to one number: entropy, measured in bits. It’s the size of the haystack an attacker has to search. Every bit doubles that haystack, so 40 bits is twice as hard to crack as 39.

Two things feed it. The character pool you draw from — 26 lowercase letters, another 26 if you add uppercase, 10 digits, a few dozen symbols — and how many characters you use. The formula is length × log₂(pool size). Ten random lowercase letters give you about 47 bits. The same ten characters using the full keyboard get you to roughly 65.

Here’s the part the old rules miss: length moves the needle harder than variety. Each extra character multiplies the possibilities, while swapping one letter for a symbol only nudges the pool a little wider. A sixteen-character string of plain words beats an eight-character jumble of $ and # almost every time.

Reading the crack-time estimate

The checker assumes the harsh case — an offline attack. That means the attacker already stole a database of password hashes and is running guesses on their own hardware, no login screen slowing them down. Modern GPUs churn through something like 10 billion guesses a second against a fast hash.

Run a few passwords through and the pattern shows up fast:

qwerty123 — instant
sunflower — a couple of minutes
T7v!kQ2m — a few hours
correct-horse-battery-staple — longer than the universe has existed

That last one is the famous xkcd example. Four random common words, no symbols, easy to remember, and it buries every eight-character “complex” password you’ve ever been forced to invent.

Where passwords actually fail

Raw entropy assumes randomness. People aren’t random, and attackers know it. So the checker also flags the shortcuts that make a password fall apart no matter how long it looks:

It’s on a breach list. password123 has around 60 bits of theoretical entropy and gets cracked immediately, because it sits near the top of every guessing dictionary.
Keyboard runs. qwerty, asdfgh, 123456 — the first things any tool tries.
Repeated characters. aaaaaa or 111111 collapses the search space.

When the tool spots one of these, it drops the score to match reality instead of the math.

A habit that beats any single password

Honestly? Stop inventing them. The strongest password is one you never see, never type, and couldn’t recite if someone asked.

Let a password manager generate and store long random ones. You memorize a single strong passphrase and nothing else.
Turn on two-factor authentication where it’s offered. Even a cracked password gets stopped at the second step.
Never reuse a password across sites. One breach shouldn’t hand over your email, your bank, and your cloud storage all at once.

Your password stays on your device the entire time you use this checker — nothing is uploaded, logged, or stored. Paste one in and watch the meter move: Password Strength Checker.