Password Crack Time Estimator

Most password strength meters show a colored bar and a made-up label — "weak", "good", "strong" — with no way to check the reasoning behind it. This tool does the opposite: it shows every step of the calculation. Type a password and watch it detect which character sets you used (lowercase, uppercase, digits, symbols), add up the resulting pool size, and plug your password's exact length and pool size into the standard entropy formula, entropy = length x log2(pool size), so you can verify the number yourself rather than trust a black box.

Entropy alone does not tell the whole story, so the tool also looks for the patterns that make a password easier to guess than its raw length suggests: sequential runs of characters like "abc" or "456", repeated-character runs like "aaa", and exact matches against a small bundled list of roughly 100 of the most common leaked passwords ever published. None of this is a connection to a live breach database — it is an honest, offline heuristic — but when a match is found, the effective entropy used for the crack-time table is reduced (or, for a common-password match, capped near the size of that list) because a real attacker would try the obvious guesses first regardless of theoretical keyspace size.

The crack-time table turns that effective entropy into real time estimates under five scenarios that span the realistic range of attacks: an online login form with rate limiting (~100 guesses/second), an online form with no rate limiting (~1,000 guesses/second), an offline attack against a slow, deliberately expensive hash like bcrypt, scrypt or Argon2 (~10,000 guesses/second), an offline attack against a fast unsalted hash such as MD5, SHA-1 or NTLM on a single consumer GPU (~10 billion guesses/second), and the same fast hash cracked on a large multi-GPU cluster (~1 trillion guesses/second). These rates are illustrative, order-of-magnitude figures drawn from commonly published hardware and hashing benchmarks — not a prediction tied to any specific attacker, device or year — and they are exactly why the same password can be "instant" against a fast offline hash and "centuries" against a slow, rate-limited one.

Everything above runs as plain JavaScript string analysis and Math.log2 arithmetic directly in your browser tab. There is no cryptographic hashing, no server round-trip and, most importantly, no network request of any kind in this tool — the password you type is never transmitted, logged or stored anywhere, and the whole page keeps working if you disconnect from the internet after it loads.