Password Strength Checker

Introduction

You think your password is strong because it has a capital letter and a number. You're probably wrong. The Password Strength Checker goes beyond simple 'weak/medium/strong' labels to give you the actual math: entropy bits, estimated crack time under real-world attack scenarios, and whether your password matches patterns found in billions of leaked credentials. This is the difference between guessing your password is secure and knowing it.

What This Tool Does

A password strength checker is a tool that evaluates the security of a password by calculating its entropy (measured in bits), detecting common patterns (dictionary words, l33tsp34k substitutions, keyboard walks, repeating characters), and estimating crack time under real-world attack scenarios. Unlike simple meters that only check character classes, this tool applies Shannon information theory to measure actual unpredictability and compares the password against patterns found in billions of leaked credentials from breaches like RockYou2024. The output includes a numerical entropy score, pattern detection results, estimated crack time at different attack speeds, and actionable feedback on why the password is strong or weak.

Why It Matters

How It Works

The checker first detects which character classes are present (lowercase, uppercase, digits, symbols) to determine the theoretical character pool size R. It calculates base entropy as L × log₂(R) where L is password length. It then applies pattern penalties: dictionary word detection subtracts 25 bits, l33tsp34k substitution detection subtracts 30 bits, keyboard walk detection subtracts 35 bits, repeating character detection subtracts 25 bits, and date pattern detection subtracts 30 bits. The effective entropy is the adjusted value after penalties. Crack time is calculated by dividing 2^entropy by the attack speed (100 guesses/second for online, 10 billion for offline GPU). The tool also checks the password against a database of breached credentials using k-anonymity — only a partial SHA-1 hash is transmitted, preserving privacy.

Step-by-Step Examples

Code Examples

function analyzePasswordStrength(password) {
  let poolSize = 0;
  const hasLower = /[a-z]/.test(password);
  const hasUpper = /[A-Z]/.test(password);
  const hasDigit = /[0-9]/.test(password);
  const hasSymbol = /[^a-zA-Z0-9]/.test(password);

  if (hasLower) poolSize += 26;
  if (hasUpper) poolSize += 26;
  if (hasDigit) poolSize += 10;
  if (hasSymbol) poolSize += 33;

  let entropy = password.length * Math.log2(poolSize || 1);

  const penalties = [];
  const l33tMap = { '@': 'a', '0': 'o', '1': 'l', '3': 'e', '4': 'a', '5': 's', '7': 't', '$': 's' };
  const deL33ted = password.split('').map(c => l33tMap[c] || c).join('').toLowerCase();

  const commonWords = ['password', 'qwerty', 'admin', 'letmein', 'welcome'];
  if (commonWords.some(w => deL33ted.includes(w))) {
    entropy -= 25;
    penalties.push('Contains common dictionary word');
  }

  if (/(.)\1{2,}/.test(password)) {
    entropy -= 15;
    penalties.push('Contains repeated characters');
  }

  const keyboardPatterns = ['qwerty', 'asdfgh', 'zxcvbn', '123456'];
  if (keyboardPatterns.some(p => deL33ted.includes(p))) {
    entropy -= 20;
    penalties.push('Contains keyboard pattern');
  }

  const combinations = Math.pow(2, Math.max(entropy, 0));
  const crackTimeSeconds = combinations / 1e10;

  return {
    entropy: Math.max(entropy, 0).toFixed(1),
    combinations: combinations.toExponential(2),
    crackTime: formatTime(crackTimeSeconds),
    rating: entropy > 100 ? 'Very Strong' : entropy > 80 ? 'Strong' : entropy > 60 ? 'Moderate' : entropy > 40 ? 'Weak' : 'Very Weak',
    penalties
  };
}

function formatTime(seconds) {
  if (seconds < 1) return 'instant';
  if (seconds < 60) return seconds.toFixed(0) + ' seconds';
  if (seconds < 3600) return (seconds / 60).toFixed(0) + ' minutes';
  if (seconds < 86400) return (seconds / 3600).toFixed(0) + ' hours';
  if (seconds < 31536000) return (seconds / 86400).toFixed(0) + ' days';
  return (seconds / 31536000).toExponential(1) + ' years';
}

console.log(analyzePasswordStrength('P@ssw0rd123'));
// { entropy: "28.4", rating: "Weak", penalties: ["Contains common dictionary word"] }

function detectPasswordPatterns(password) {
  const patterns = {
    dictionary: false, l33tsp34k: false, keyboard: false,
    repeating: false, sequential: false, date: false
  };

  const l33tMap = { '@':'a','0':'o','1':'l','3':'e','4':'a','5':'s','7':'t','$':'s' };
  const normalized = password.split('').map(c => l33tMap[c] || c).join('').toLowerCase();

  const top100 = ['password','123456','12345678','qwerty','abc123','monkey','master'];
  if (top100.includes(normalized)) patterns.dictionary = true;

  if (password !== normalized && normalized !== password.toLowerCase()) {
    patterns.l33tsp34k = true;
  }

  const kbRows = ['qwertyuiop','asdfghjkl','zxcvbnm','1234567890'];
  const lower = password.toLowerCase();
  for (const row of kbRows) {
    for (let len = 4; len <= row.length; len++) {
      for (let i = 0; i <= row.length - len; i++) {
        const seq = row.slice(i, i + len);
        if (lower.includes(seq)) patterns.keyboard = true;
      }
    }
  }

  if (/(.)\1{2,}/.test(password)) patterns.repeating = true;

  return patterns;
}

console.log(detectPasswordPatterns('P@ssw0rd123'));
// { dictionary: true, l33tsp34k: true, keyboard: false, repeating: false }

Benefits

• Analyzes password entropy using Shannon information theory for mathematically accurate strength measurement.
• Detects l33tsp34k substitutions, dictionary words, keyboard walks, and other common patterns attackers exploit first.
• Provides real-world crack time estimates based on current GPU hardware capabilities (10B+ guesses/second).
• Flags passwords found in known breach databases — checking against billions of leaked credentials.
• Offers specific, actionable feedback on why a password is weak rather than just a vague rating.

Use Cases

Common Mistakes to Avoid

Security Implications

Security Information

All analysis runs client-side in your browser. Password data is never transmitted to external servers. When checking against breach databases, only a partial SHA-1 hash (first 5 characters) is sent using k-anonymity — your full password never leaves your device. The entropy calculations are based on Shannon's information theory and are mathematically provable. Pattern detection uses the same techniques as commercial password crackers (Hashcat rules, John the Ripper wordlists) to identify weaknesses before attackers do.

Best Practices

• Aim for 80+ bits of entropy for general accounts, 100+ bits for high-value accounts like email and banking.
• Don't trust simple 'weak/medium/strong' meters — verify that the tool detects patterns, not just character classes.
• Check your existing passwords against breach databases immediately — if they appear, replace them.
• Use cryptographically generated passwords (16+ characters) stored in a password manager instead of creating passwords yourself.
• Ignore advice to add special characters at predictable positions — random placement is stronger.