Password Strength Checker

The score it shows you is actually a worst-case estimate, not an average

Typing a password here shows you entropy, estimated crack time, and which patterns the checker found. The crack time comes from assuming a fast offline attack — something like a GPU cluster running 10 billion guesses per second — not a slow rate-limited web login. So when it says "3 hours," that's the harder scenario. At normal web login speeds your password would last years. That said, the check for common patterns matters more than the raw entropy number. Tr0ub4dor&3 looks complex but scores poorly because l33t-speak substitutions are well-known and appear near the top of every dictionary attack list. Actual randomness — either a randomly generated password or a genuinely random passphrase — is harder to crack than something that looks complex to a human but follows a recognizable pattern.

The passphrase approach often scores higher than it looks

Four random dictionary words strung together — something like marble-fence-clock-brisk — has more entropy than most 10-character passwords people come up with on their own. It's also dramatically easier to remember and type on a phone. The weakness is that people don't pick words randomly; they pick words that mean something to them, which halves the search space quickly. If you're going the passphrase route, let the tool or a dice roll pick the words, not your own associations. The checker here will show you what the entropy of your choice actually is either way.