STRPassword Strength Meter
Measure password strength with zxcvbn — entropy, crack time estimate, and suggestions, all in-browser
Input is processed locally and never sent to a server.
Password Strength Complete Guide
This tool is powered by zxcvbn, the algorithm developed by Dropbox engineering. It evaluates the real-world guessing difficulty of a password — simulating how actual attackers operate rather than applying simple rules about character types and length. All analysis runs locally in your browser; your password never leaves your device.
Entropy Calculation — The Math Behind Password Strength
The core metric of password strength is entropy:
Entropy (bits) = log₂(charset size) × password length
| Character Set | Size | bits/char | 12-char entropy |
|---|---|---|---|
| Lowercase only | 26 | 4.7 | 56 bits |
| Upper + Lower | 52 | 5.7 | 68 bits |
| Upper + Lower + Digits | 62 | 5.9 | 71 bits |
| Full mixed charset | 94 | 6.5 | 78 bits |
60+ bits is generally considered secure; 80+ bits is very strong.
Understanding the zxcvbn Algorithm
zxcvbn uses pattern recognition rather than simple rules:
- Dictionary attack: Checks against 100k+ word lists (English, names, top passwords)
- Keyboard patterns: Detects qwerty, asdf, 1234 and adjacent key walks
- Dates/years: Recognizes 19xx, 20xx, MMDD formats automatically
- L33tspeak: Detects substitutions like @ → a, 0 → o
- Repetition/sequences: Penalizes aaaa, abcabc patterns
Commonly Cracked Password Patterns (What to Avoid)
- Dictionary word + number:
password123,monkey2023 - Keyboard walks:
qwerty,1qaz2wsx - Name + birthday:
john1990,kim0301 - L33tspeak:
p@$$w0rd— attackers already know this trick - Repetition:
aaaaaa,111111
Tips for Strong Passwords
- At least 12 characters; 16+ is even better
- Mix uppercase, lowercase, digits, and symbols
- Use a passphrase with 4 random words:
correct-horse-battery-staple - Use a unique password per site — never reuse
- Use a password manager like 1Password or Bitwarden
FAQ
Not necessarily. Entropy measures raw randomness; zxcvbn measures exploitable patterns. Password1234! looks high-entropy but scores low on zxcvbn. Check both.
Yes. A 4-word passphrase like correct-horse-battery-staple is memorable and has very high entropy — as long as the words are chosen randomly.
NIST guidelines (SP 800-63B) no longer recommend periodic changes. Instead, change immediately when a breach is detected or suspicious activity occurs.
Yes. zxcvbn runs entirely in your browser. No network requests are made, so your password is never transmitted anywhere.