Password Strength Checker — Entropy, Crack Time, and HIBP Breach Lookup

What is Password Strength?

A password strength checker measures how hard your password would be to guess. Naive checkers just count characters and character classes; serious ones (this tool included) model real attacker behavior: dictionary words, keyboard patterns, l33t substitutions, and repeated tokens. The result is expressed as entropy (bits) and cracker time under offline vs. online, fast-hash vs. slow-hash scenarios.

How to check a password

1. 1Type or paste the password into the input. Toggle the eye icon if you want to verify what you typed.
2. 2Read the entropy (in bits): 60+ is fine for most sites, 80+ is strong, 128+ is overkill except for master passwords.
3. 3Scan the four crack-time estimates — online throttled (10/hr), online unthrottled (10/sec), offline GPU fast hash (10¹⁰/sec), offline bcrypt slow hash (10/sec).
4. 4Optionally click 'Check breach database' — the tool sends only the first 5 chars of the SHA-1 hash to Have I Been Pwned (k-anonymity, RFC-style) and compares locally.
5. 5Fix any listed weaknesses (dictionary words, keyboard walks, low character variety) and try again.

Use Cases

Code Examples

// Entropy of a password from a known-size alphabet:
// bits = length * log2(alphabet_size)
const alphabet = 26 * 2 + 10 + 32; // upper + lower + digits + symbols
const bits = password.length * Math.log2(alphabet);

const hash = await sha1(password); // hex, uppercase
const prefix = hash.slice(0, 5);
const suffix = hash.slice(5);
const res = await fetch("https://api.pwnedpasswords.com/range/" + prefix);
const body = await res.text();
const hit = body.split("\n").find(l => l.startsWith(suffix));
const count = hit ? Number(hit.split(":")[1]) : 0;

from zxcvbn import zxcvbn

result = zxcvbn("Summer2024!")
print(result["score"])            # 0-4 crack difficulty
print(result["crack_times_display"])  # human-readable estimates

Key Concepts

Entropy

Measured in bits. Each additional bit doubles the guess-space. A truly random 8-char password from a 94-char alphabet has ~52 bits. Human-chosen passwords typically have far less because we pick predictable patterns.

Fast hash vs. slow hash

Fast hashes (MD5, SHA-1, SHA-256) let a GPU test 10¹⁰ guesses/sec. Slow hashes (bcrypt, scrypt, Argon2) deliberately cap at ~10-100/sec even on GPUs — turning a 2-day crack into 5000 years. If a site leaks a fast-hashed password DB, your password needs to be much stronger than if it were bcrypted.

Have I Been Pwned (HIBP)

A public database of ~800M passwords from historical breaches. Any password that appears here is 'known' to attackers — they'll try it first regardless of how strong it looks. The k-anonymity API lets you check without ever sending the full hash.

Dictionary attack

Instead of brute-forcing all combinations, an attacker tries a wordlist of leaked passwords, English words, names, dates, and their variants (`Password!` → `P@ssw0rd!` etc.). `Sunshine123` has 60+ bits of naïve entropy but is cracked in milliseconds by any real attacker.

Tips & Best Practices

• ▸Length beats complexity. `correcthorsebatterystaple` has more entropy than `P@$$w0rd!` even though the latter uses more character classes.
• ▸Never reuse a password across sites. When one gets breached, credential-stuffing attacks try it on everything you've ever signed up for.
• ▸Use a password manager. Store one strong master passphrase (128+ bits, memorize it), let the manager generate 20-char random passwords for everything else.
• ▸For truly high-value accounts (bank, email, password manager itself), add a hardware security key (FIDO2 / WebAuthn). Even a leaked password can't be used without physical possession.