Password Strength Checker

Estimates password strength using entropy = length × log₂(character pool size), then penalizes for common patterns: common passwords, keyboard sequences (qwer, asdf), repeated characters. Reports crack time across three threat models — online throttled (100 guesses/sec), offline slow hash like bcrypt (10k/sec), offline fast hash like SHA-256 (10B/sec). Password is never stored, transmitted, or logged.

The pool-size formula describes a password drawn at random from that pool, which yours almost certainly was not. A human-chosen password lands in a far smaller space than its character set implies, because people pick words, capitalise the first letter, put the digit and the punctuation at the end, and substitute 3 for e. The pattern penalties here correct for the most common of those habits, but no heuristic catches all of them, so treat the number as an upper bound on strength rather than a measurement of it.

The three threat models differ by more than their labels suggest, and the gap between them is usually larger than any change you make to the password. The same secret that would survive centuries of throttled online guessing falls in hours against a GPU running fast hashes. Which model applies is a property of the service storing the password, not of the password, and you generally have no way to find out which one a given site uses.

Length dominates everything else. Adding one character multiplies the search space by the pool size, while adding one more character class multiplies it once and only from that point on, so a long passphrase of ordinary words beats a short string of symbols by a wide margin.

None of this measures the risk that actually breaks most accounts. A password of any strength is worthless once it appears in a breach corpus, and reuse across sites is what turns one breach into many. A password manager and distinct passwords per site matter more than any score here, and multi-factor authentication matters more than both.