Password Strength Checker & Policy Tester

Model a corporate password policy against real-world crack-time and entropy estimates.

A password meter that only outputs "strong" or "weak" hides the actual question, which is strong against what. This tool estimates entropy from the character classes your password actually uses, then translates that entropy into an estimated crack time across four genuinely different attack models — because a password that would survive years against a rate-limited login form can fall in seconds against an offline GPU cracking an unsalted hash.

How to check a password against your policy

  1. Set the policy first: a minimum length (12 by default), which character classes are required, and any disallowed substrings such as your company name.
  2. Type or paste the candidate into the Test a password box; every figure updates on each keystroke.
  3. Read the character-set estimate in bits, the strength band, and the breach-list result, then the four crack-time estimates below them.
  4. Check the policy evaluation list, where each rule shows as passed or failed so you can see exactly which requirement a password misses.

How the entropy number is actually computed

The password is scanned for which character classes it draws from — lowercase, uppercase, digits, symbols — and entropy is estimated as length times the log base two of the resulting pool size, the standard formula for a password treated as drawn uniformly at random from that character set. A twelve-character password using all four classes scores meaningfully higher than a twelve-character password using only lowercase letters, even though both are the same length.

This estimate necessarily treats the password as if it were random. A twelve-character password that's actually a real word with a capital letter and a digit tacked on has far less real-world entropy than this formula credits it with, because dictionary and pattern-based attacks don't guess character-by-character at random — the entropy score is a ceiling, not a guarantee of actual resistance to a smart attacker.

What makes a strong password

Password length vs. crack time

These figures come from this tool's own formula under the offline fast-hash model (10 billion guesses per second, average case of half the keyspace). They illustrate scale for truly random characters and say nothing about a password a person picked.

Passphrases vs. complex passwords

A passphrase of randomly chosen words gets its strength from the size of the word list rather than from symbols. Drawn from the 7,776-word EFF long list, each word adds about 12.9 bits, so four words give about 51.7 bits and six give about 77.5 — the same as a random twelve-character password using all four classes, but far easier to type and remember. What matters is that the words are picked at random, not taken from a lyric or a phrase you like.

Symbol-heavy passwords that people invent tend to follow habits: a capital first letter, a word, a year, an exclamation mark. Summer2026!! passes the default policy here and earns 77.5 bits from the character-class formula, yet a pattern-aware cracker would try it early.

Be aware that this page cannot tell words from characters. It scores a passphrase by its letters, so correct horse battery staple, with its spaces counted as symbols, is credited with about 160 bits even though four common words carry nowhere near that much. Read the estimate for a passphrase as a ceiling, and count the words yourself.

Four attacker models, not one crack-time number

Why those numbers are round, illustrative figures

Each preset's guess rate is a deliberately round order-of-magnitude figure meant to bracket realistic attacker capability, not a benchmark of any specific hardware or hashing algorithm. Real crack speed for a given hash function varies with the exact algorithm, cost parameters, and hardware available, sometimes by an order of magnitude either way. Treat the four crack-time estimates as showing the shape of the gap between attack models rather than a precise prediction for your exact scenario.

Policy rules and the breach-list check are separate signals

The policy editor lets you require a minimum length, specific character classes, and a list of disallowed substrings — your company name or the word password, for instance — matched case-insensitively regardless of where in the password they appear. A password can satisfy every rule in the policy and still be flagged separately as compromised if it exactly matches an entry in the bundled common-password list, since a high entropy score and appearing on a leaked-password list are independent facts.

That bundled list is a small, illustrative sample of frequently observed breached passwords, current as of August 2026 — not the full corpus of hundreds of millions of real leaked credentials, which would need a server-side or downloadable dataset far larger than a page can ship. A password not flagged here has only cleared this small sample, not a comprehensive breach database.

What never leaves this page

The password you type is used only for the in-memory entropy and rule computation happening in this tab. It is never logged, never stored, and never transmitted over the network in any form — you can confirm that yourself by watching your browser's network panel while typing.

Questions people ask about Enterprise Password Policy & Hash Entropy Tester

Why did a 20-character password score lower than a 12-character one?
Entropy here is length multiplied by the log of the character pool, and the pool depends on which classes appear. Twenty digits draw from a pool of 10 and score about 66 bits, while twelve characters mixing upper, lower, digits and symbols draw from 88 and score about 77.5 bits. Twenty lowercase letters, by contrast, reach about 94 bits and beat both.
Is the estimated crack time an exact prediction?
No — the four attacker presets use deliberately round, order-of-magnitude guess rates meant to bracket realistic scenarios, not benchmark a specific piece of hardware or hash algorithm. Real crack speed depends on the exact hashing scheme, its cost parameters, and the hardware actually deployed against it, so treat the numbers as illustrating scale, not a guaranteed timeline.
What does it mean if my password is flagged as compromised?
It means the exact password, ignoring case, matches an entry in a small bundled sample of commonly breached passwords. It's a real red flag when it triggers, but the sample is illustrative and far smaller than the hundreds of millions of credentials in actual public breach compilations, so passing this check is not proof a password has never appeared in a real leak.
Does this tool store or send my password anywhere?
No. Every calculation — entropy, crack time, policy rules, and the breach-list match — runs in memory in your own browser tab against the password as you type it. Nothing is logged, saved to storage, or sent over the network at any point.
How long should a password be?
For a random password stored in a password manager, 16 characters or more keeps even the fastest attack model on this page far out of reach. For something you type by hand, a passphrase of five or six random words is easier to live with and similarly strong.
Is a passphrase more secure than a complex password?
It can be, when the words are chosen at random: six words from the EFF long list carry about 77.5 bits, matching a random twelve-character mixed password. A phrase you made up yourself, or a famous quote, is much weaker than its length suggests.
What makes a password strong?
Length, true randomness, and being used on only one account. Character variety helps a little, but a long random password or passphrase from a generator matters far more than the symbols a composition policy demands, and a unique password limits the damage when one site is breached.

Related tools on BrakeTools

Content reviewed 2026-09-27.