Password Strength Checker — Entropy, Crack Time, and HIBP Breach Lookup

Three passes: (1) A character-pool entropy estimate — length × log2(pool size), where pool depends on which of lowercase/uppercase/digits/symbols you used. (2) Structural penalties — being a well-known weak password (like 'password123'), containing a keyboard sequence (qwerty, 1234, abcdef), being all-digits, or repeated patterns like 'abcabc' subtract entropy. (3) Positive findings for length and character-class diversity. The final 0–4 score maps to Very weak / Weak / Strong / Very strong.

They model different attacker capabilities. (a) Online throttled: guessing against your login form with rate limits (~10/s). (b) Online unthrottled: same but no rate limits (~100/s). (c) Offline fast hash: attacker has stolen a password database hashed with something fast like SHA-1 or unsalted MD5, using a GPU cluster (~10 billion tries/s). (d) Offline slow hash: attacker has a bcrypt/scrypt/Argon2 database (~10k tries/s per GPU). If (d) is still centuries, you're in great shape.

Not for the strength analysis — everything runs locally. The only time any data leaves your browser is if you explicitly click 'Check breaches', which uses the Have I Been Pwned k-anonymity API: your password is SHA-1 hashed locally, and only the first 5 hex chars of the hash are sent. HIBP returns all matching hash suffixes and the comparison happens locally. Your actual password never touches the network.

Have I Been Pwned (haveibeenpwned.com) maintains a database of ~800 million passwords found in public breaches. The k-anonymity API is a privacy-preserving query: you send only the first 5 characters of your password's SHA-1 hash (a prefix that matches ~450 hashes on average), and the server sends back all matching hash suffixes along with breach counts. You do the final comparison locally. The server never learns your password.

Rotate it immediately. Even a 20-character mixed-case password with symbols has zero real-world security if it's on attackers' pre-computed wordlists — they'll try it before doing any brute-force work. Uniqueness beats theoretical entropy every time. Use our Password Generator to make a fresh one and store it in a password manager.

zxcvbn (Dropbox's popular strength library) is excellent but ~400KB gzipped — that's more than the entire rest of this site's JavaScript. We use a lighter approach: keyboard-sequence detection, common-password check, repeated-pattern detection, plus the character-pool entropy formula. Not quite as sharp as zxcvbn on obscure patterns, but catches 95% of the meaningfully bad choices at 1% of the size.