Password Strength Checker

1. Why a checker is different from a generator

A password generator creates new random passwords for you; a strength checkerevaluates passwords you already have. The two tools are complementary: the generator is the right answer when you do not have a password yet and need a strong one in seconds; the checker is the right answer when you have a password you are considering — one you just made up, one your workplace assigns, one a relative suggests, or one you have been reusing for too long and want to audit before the next breach. The checker tells you whether to keep what you have or replace it; the generator gives you the replacement. Use both in sequence: check what you have, replace the weak ones with freshly-generated strong ones.

2. Cracking time estimates and what they actually mean

The checker’s cracking-time estimate answers the question “if an attacker had the hashed version of this password and unlimited attempts against a powerful rig, how long would it take them to find it?” The answer is the entropy of the password converted to time, using approximations of modern cracking throughput: a single high-end GPU (~10^10 guesses/sec) for offline attacks, a server farm (~10^12 guesses/sec) for the largest attacks. The estimates are deliberately conservative — they take the upper end of realistic attack capacity — so when the checker says “cracked in 4 hours,” the truth is somewhere between “in 4 hours on a single GPU" and “already compromised by anyone with a dictionary.” The relative comparison is the useful output: this password will last years, that one will last seconds.

3. The three classes of attack — which one applies depends on the breach

• Online attack with rate limits — the attacker tries passwords against the live login, is throttled to a handful per second at best, blocked after several failures. A 6-character password is fine here simply because the server’s rate limiter stops the attack. But this attack only works when the password is novel to the targeted account.
• Offline attack against a stolen hash — the attacker exfiltrates the password hash from a breach and runs an unlimited-rate attack against it on their own hardware. Here, the only thing standing between the password and recovery is its entropy; rate limits are gone. This is the threat model the checker’s entropy is designing against.
• Dictionary attack with common-password lists — a sub-case of offline attack where the attacker uses cumulative lists of breached passwords (rockyou and descendants). Passwords in the dictionary fall in seconds, regardless of their surface complexity; entropy calculations on dictionary-listed passwords are a polite fiction.

The takeaway: anypassword protecting an account that has been or could be breached in a database leak must resist offline attack, and the only thing resisting offline attack is entropy (length times pool size, less the dictionary membership penalty). This is the threat model that drives the checker’s calculations.

4. The improvement suggestions the checker makes — and why they work

When the checker grades a password as weak, it offers specific suggestions — add length, add character classes, avoid common patterns. The most impactful suggestions, in order:

• Add length first. Length is the highest-leverage variable. Going from 8 to 12 characters of random mixed-class content roughly triples the entropy.
• Replace common-pattern passwords entirely. Password123 is in every dictionary; no amount of additional characters on top of it makes it safe. Replace, do not extend.
• Include symbols when you can type them reliably. Symbols roughly double the effective pool. But if you will need to type the password on a foreign keyboard where symbols are awkward, prefer length over symbols.
• Avoid keyboard walks — qwerty, asdfgh, 1qaz2wsx are in common-password dictionaries.
• Avoid dates and names — 1990s birthdates and family-member names are the first attack dictionaries tried.

5. The honest strength meter and the honest suggestion

An honest meter grades your current password, suggests changes that genuinely increase entropy rather than only the surface complexity, and does not reward password patterns that score well and crack in milliseconds. This tool reports the password’s entropy in bits, classifies it into a named band, estimates cracking time, and identifies the highest-leverage change to make. Where the password is in the common-password dictionary it tells you so plainly rather than papering the problem with a green checkmark. The honesty is the user-service; the theatrical meter that grades P@ssw0rd1!as “very strong” is the opposite of service.

6. Why this belongs in your browser

The privacy case for a browser-based password checker is unusually strong: the password you are checking is a real password. Submitting it to a remote service means the service has it, regardless of any promises about telemetry or retention. This tool runs the entropy calculator, the common-password dictionary check, and the suggestion engine entirely inside your browser; the dictionary is copied locally. There is no upload, no telemetry, no third party, no log. The password you check stays on the machine you typed it on — which is the only acceptable behaviour for this category of tool.

Conclusion

A password strength checker is a privacy-sensitive tool that is most useful when it grades honestly, suggests the highest-leverage improvements, and runs entirely in your browser. Entropy reporting, common-password dictionary checks, cracking-time estimates, named strength bands, and zero-upload browser execution together compose a tool the user can trust both in its privacy model and in its honesty. Pair with the Random String Generator for replacements and the password manager for storage, and the full password hygiene workflow is covered.