FIG. I — INPUT
Analyzed entirely in your browser · nothing sent · nothing stored
Section III 03 — what to do next

Three practical steps. None require panic.

  • № 01
    Generate a stronger replacement. If the verdict above is anything but "strong", swap the password on this account first. Use the generator to make a new one — long, random, and unique to this site. Open Password Generator →
  • № 02
    Check whether it's already leaked. Even a "strong" password is risky if it's been exposed in a breach. The Password Breach Checker tells you whether yours has appeared in known leaks. Open Password Breach Checker →
  • № 03
    Use a password manager. Strength is only useful when paired with uniqueness. A manager lets you have a different strong password for every account without remembering any of them.
FIG. IV — how this works

We measure entropy, not just length.

  1. 01
    Calculate the search space. We look at which character sets you've used (lowercase, uppercase, numbers, symbols) and multiply by the password length. This gives the number of possible passwords an attacker would have to try.
  2. 02
    Estimate cracking time. Modern attackers can guess about 1 billion passwords per second with consumer hardware — far more with cloud GPUs. We divide the search space by that rate to estimate worst-case crack time.
  3. 03
    Penalize common patterns. Dictionary words, names, dates, "word + 123" suffixes, and other human patterns shrink the effective search space dramatically. We subtract from the entropy estimate when we spot them.

The whole calculation runs in your browser. We never see what you typed. Strength is a useful estimate, not a guarantee — pair this with breach checking and a password manager for real protection.