Password Strength Analyzer

About this interactive

What you're seeing: a sample password priced twice. The left panel detects which character classes are actually in the string, sums them into a charset size R, and prints the textbook entropy L x log2(R) with the arithmetic shown. The right panel turns that into average crack time — guesses = R^L / 2, so seconds = 2^(bits-1) / rate — at 100 per second (a throttled login form), 10 million per second (an offline crack of a stolen hash on ordinary hardware) and 1 billion per second (the same crack with a GPU against a fast hash). Then it does it all again in a second column, this time pricing each part of the string the way an attacker would rather than the way the formula does. Why it matters: the two columns disagree, sometimes by fifty bits, and the disagreement is the entire lesson. Password123! spends all four character classes and scores 78.8 keyspace bits, a number that looks unbreakable and is meaningless, because 'password' is one entry in a wordlist, '123' is one of a few dozen sequences, and the trailing '!' is the most predictable character in the string — so a rule-driven crack reaches it in under a day online and instantly offline. Entropy measures the size of a keyspace; it does not measure whether anyone would search that keyspace in order. How to use it: start with abc and watch how little three characters buy, then step through Password123! and Summer2024! and read the 'what a cracker would notice' list, then type something with no structure at all — xK7#pQ2mZv9! — and watch the two columns snap back into agreement, which is what randomness actually looks like. Finish by comparing four unrelated words against one decorated word of the same length, and note which one the second column prefers. Nothing you type leaves your browser: there is no network call and no storage in the document, which is why it is safe to experiment — but type samples, not a password you use.

How to use this tool

This is a demonstration, not a login form. Nothing you type is sent anywhere, stored anywhere, or seen by anyone — there is no network call and no storage of any kind in this tool. Type samples, not a password you actually use.

Panel 01 — the sample. Type a string, or press one of the buttons. The four boxes light up for the character classes actually found in it: a–z, A–Z, 0–9, and symbols. The charset size R is the sum of the classes present — 26 + 26 + 10 + 33 = 95 if all four are there. The symbol class is counted as 33: the 95 printable ASCII characters minus the 62 letters and digits, space included. Entropy is then length × log₂(R), in bits, and the line under the boxes shows the arithmetic.

Panel 02 — the time. On average an attacker finds a password halfway through the keyspace, so guesses = R^L ÷ 2 and the time is that divided by the guess rate. Three rates, because they are three different situations: 100/sec is a throttled login form on the internet, 10M/sec is an offline crack of a stolen hash on ordinary hardware, and 1B/sec is the same crack with a GPU against a fast hash. The jump between them is what stealing a password database buys an attacker.

Read both columns. The left column assumes brute force — that the attacker enumerates the keyspace. The right column prices the string the way a real cracker would: a word from a wordlist is one guess, not 26ⁿ; 123 is one of a few dozen sequences; a trailing year is one of a couple of hundred; @ for a and a capital in front are undone by a rule engine for about a bit each. Anything with no recognisable structure is charged the full brute-force price, so a genuinely random string scores the same in both columns.

The exercise: type Password123!. It uses all four character classes and scores 78.8 keyspace bits, which sounds unbreakable — and the right-hand column says under a day online and instantly offline. That gap is the whole point. Entropy measures the size of the keyspace; it does not measure whether anyone would search it in order. Then type xK7#pQ2mZv9! and watch the two columns agree, which is what randomness looks like. Finally compare four unrelated words against one decorated word of the same length, and see which one the second column prefers.

The strength bar and the improvement tip are both driven by the pattern-aware number, not the raw one. The penalty figures are round numbers chosen to be legible — a wordlist hit at 2¹⁴, a sequence at 2⁶ — not measurements of any particular attacker.

What you'll learn

Calculate a password's keyspace entropy in bits from its length and the character sets it actually contains, and convert that entropy into an average crack time at online and offline attack speeds
Explain why a password with high keyspace entropy can still be recovered in seconds when it is assembled from a dictionary word, a sequence, a keyboard walk, or a predictable mask

Aligned to

CompTIA PenTest+

4.3 Given a scenario, perform authentication attacks using the appropriate tools.

CompTIA Security+

4.6 Given a scenario, implement and maintain identity and access management.

2.2 Explain common threat vectors and attack surfaces.

Key terms

Brute Force Attack: An attack method that systematically tries all possible combinations of passwords or keys until the correct one is found.
Dictionary Attack: A type of brute force attack that uses a predefined list of common words and phrases to guess passwords.
Mask Attack: A password cracking technique that exploits known patterns in passwords — such as a capital letter followed by lowercase letters and ending in numbers — to dramatically narrow the search space compared to a full brute-force attempt.
Wordlist: A file containing a list of candidate passwords used in a dictionary-based attack, where each entry is hashed and compared against the target hash.
Hashcat: An open-source password recovery and cracking tool that recovers plaintext passwords by comparing computed hash values against wordlists, brute-force sequences, or generated candidate patterns. It is widely used in authorized penetration testing and forensics.
Passphrase: A sequence of words or a sentence used as a password, combining length and memorability to create a strong authentication credential.
Password Policy: A set of organizational rules governing the creation, complexity, expiration, and management of user passwords to reduce security risk.
Credential Stuffing: An automated attack in which stolen username and password pairs from one breached service are systematically tested against other services to gain unauthorized access. It exploits users who reuse passwords across multiple accounts.

Topics

Password Cracking Entropy Brute Force Dictionary Attack Mask Attack Authentication Password Policy Interactive

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →