Type any password to see its entropy in bits, a strength rating, and estimated crack times across four real-world attack speeds. Purely client-side — nothing you type is ever sent anywhere.
| Attack Scenario | Guess Rate | Est. Time to Crack |
|---|
Start typing a password above to see its strength analysis
This password strength calculator scores any password you type using actual entropy math rather than a vague "weak / medium / strong" guess. It's a dedicated password entropy calculator and crack time calculator: type a password and it immediately computes how many bits of entropy it contains, places it into a strength band, and estimates how long it would take an attacker to guess it under four realistic attack scenarios — from a rate-limited login form to an offline GPU cluster testing billions of guesses per second. This is distinct from the strength checker built into NeftCal's Password Generator page — this tool is a standalone scoring and crack-time reference built around a visible entropy formula, chart, and full comparison table, for anyone who wants to understand why a password is rated the way it is, not just generate a new one.
The calculator scans your password for which character pools it draws from — lowercase letters (26 possibilities), uppercase letters (26), digits (10), and symbols (about 32) — and sums the pools actually present to get the effective character set size. Entropy in bits is then length × log₂(character set size): each additional character multiplies the number of possible passwords, so entropy grows roughly linearly with length but the search space itself grows exponentially. That entropy number is converted into an estimated crack time at four guess rates — 100 guesses/hour (throttled online login), 1,000 guesses/second (unthrottled online), 10,000 guesses/second (offline slow hash such as bcrypt), and 10 billion guesses/second (offline fast hash on a GPU cluster) — using the standard average-case formula: expected crack time ≈ 2^entropy_bits ÷ guess rate ÷ 2.
The same password can be "uncrackable in centuries" against a rate-limited login form and "cracked in seconds" against an attacker who has stolen a password database hashed with a fast, weak algorithm. Understanding entropy and crack time helps you reason about real risk instead of relying on arbitrary complexity rules like "must contain a symbol" — a long passphrase built from random words often has far higher entropy, and is easier to type and remember, than a short password stuffed with special characters.
Entropy measures unpredictability in bits. Each bit doubles the number of possible passwords an attacker must try. A password with 60 bits of entropy has roughly 2^60 (about 1.15 quintillion) possible combinations in its search space.
The same 2^entropy search space takes wildly different real time depending on guess rate — from centuries against a throttled login form to minutes against an offline GPU cluster cracking a weakly-hashed database.
Entropy math assumes uniformly random characters. Real-world passwords cluster around common words, names, and patterns, so dictionary and rule-based attacks often crack "high entropy" passwords far faster than brute force alone.
Common questions about password entropy and crack time
Explore other developer & tech tools