Password Strength Tester

The Password Strength Tester analyzes any password for entropy (measured in bits), estimates how long it would take to crack via brute-force at modern hardware speeds, and (optionally) checks whether the password has appeared in a known data breach — using the Have I Been Pwned k-anonymity API, which reveals only the first 5 characters of the password's SHA-1 hash. Your actual password never leaves your device.

Password strength is more nuanced than 'has uppercase + digit + symbol'. A password like `P@ssw0rd1` looks complex by that rule but is one of the most guessed strings on earth. Real strength comes from length, unpredictability and absence from breach corpora. This tool measures all three and gives you a straight answer.

Use it to vet new passwords before committing them to a password manager, to check whether a candidate for a shared secret has been leaked, to test your organization's password policy's real-world effectiveness, or to educate users about why long random passwords beat short 'complex' ones. Combine with the Password Generator for a full generate-then-verify workflow.