# Check password strength

> Type a password and see its length, character classes, entropy bits, an offline crack-time estimate, and a strength verdict.

Open the tool: https://yourbrowsercandoit.com/password-checker

Check password strength with zxcvbn-style heuristics. Free, no signup. Runs entirely in your browser; files are never uploaded.

## How it works

The tool scores the password on three dimensions: length, the number of character classes used (uppercase, lowercase, digit, symbol), and the calculated entropy (bits = length × log2(pool size)). A heuristic combines these into a verdict from Very weak to Excellent, with a color-coded strength meter. The offline crack-time estimate assumes 10 billion guesses per second (typical for a fast offline attack on a slow hash like bcrypt). Crack times above 1000 years show as centuries. This is a basic entropy scorer, not a dictionary or breach check. It can't tell you that a common substitution like P-at-ssw0rd123 is already in every cracker's wordlist (it is), only that it's longer than 8 characters and uses four classes. Real-world password security is also about not reusing passwords across sites; this tool only scores a single password's strength against guessing.

## How to use it

1. **Type a password.** Scoring is purely local — nothing is transmitted, logged, or stored.
2. **Read the verdict.** Length, character classes, and entropy bits combine into a strength rating.
3. **Check the crack-time estimate.** It assumes 10 billion offline guesses per second; aim for 100+ bits of entropy.
4. **Remember the limits.** This is an entropy scorer, not a breach or dictionary check — common patterns still rate too high.

## Frequently asked questions

### Is my password sent anywhere?

No. The scoring is purely local heuristics. Nothing is transmitted, logged, or stored.

### Why is 'P@ssw0rd123' rated higher than it should be?

This is an entropy scorer, not a dictionary check. It doesn't know which patterns are in cracker wordlists. For a real-world check, also assume any common substitution pattern is known.

### What's a good entropy target?

60 bits is fine for low-value accounts. 100+ bits is excellent. Random 20-character passwords with mixed classes hit ~130 bits.

### Does this check if my password has been breached?

No. For breach checks, use a tool that queries Have I Been Pwned with a hashed prefix (the safe k-anonymity protocol).

## Related tools

- [JSON to CSV](https://yourbrowsercandoit.com/json-to-csv): Turn JSON into a CSV table, nested fields and all.
- [CSV to JSON](https://yourbrowsercandoit.com/csv-to-json): Convert CSV to a JSON array, with live preview.
- [Password generator](https://yourbrowsercandoit.com/password-generator): Generate strong random passwords with crypto entropy.
- [JSON formatter](https://yourbrowsercandoit.com/json-formatter): Format, validate and fix JSON, with a tree view.
- [Regex tester](https://yourbrowsercandoit.com/regex-tester): Test regular expressions with live highlighting.
- [URL encoder](https://yourbrowsercandoit.com/url-encoder): Encode or decode URLs and query parameters.