Password Strength Checker
Most checkers score character classes: one uppercase, one digit, done. That model is outdated and easy to game. This tool computes the entropy that actually matters: charset entropy minus dictionary and pattern penalties, then an offline crack-time estimate against a 100-billion-guesses-per-second attacker.
The estimator is a conservative, offline attacker model. VaultKeepR goes further: keys are derived with Argon2id, which multiplies every guess cost, so real-world cracking against a vault is far slower than the figures shown here.
Start typing: entropy, penalties, and crack time update live.
Everything runs in your browser. Nothing is sent, logged, or stored: you can disconnect from the internet and this page still works.
How entropy is computed
A random password over a pool of N characters and length L carries L x log2(N) bits of entropy: 8 characters over a 95-symbol keyboard gives about 52.7 bits. That number alone overstates real security, so it is then reduced:
- Dictionary penalty: words from the EFF large wordlist (7776 words) and common passwords are detected after common substitutions (a to @, s to $, o to 0). Each match removes bits proportional to the matched length.
- Pattern penalties: keyboard walks (azerty, qwerty, 123456), alphabetical or numeric runs, repeated characters, and repeated blocks all remove bits.
- Crack time: effective bits are converted to time at 10^11 guesses per second, the order of magnitude of an offline GPU attack against a fast hash. VaultKeepR derives keys with Argon2id, which slows every guess dramatically more; the estimate shown is deliberately conservative.
The practical takeaway matches NIST SP 800-63B guidance: length beats composition rules. A five-word passphrase from a wordlist outruns a 10-character symbol soup.
Checking passwords is step one. Storing them is the point.
VaultKeepR is a zero-knowledge password manager: your master password never leaves your device, vault sync is content-addressed, and recovery is split into fragments. No account, no email required.
FAQ
Is my password sent anywhere?
No. The computation runs in JavaScript in your browser tab. You can load the page, disconnect, and keep testing.
Why does my 16-character password score lower than expected?
It probably contains a dictionary word, a keyboard pattern, or a year. Those are the first things cracking tools try, so the estimate removes the bits they invalidate.
What entropy should I aim for?
80 bits and above for a master password, 60 bits minimum for anything important. Passphrases of 5 random words reach 64 bits and stay memorable.