devpack
Site Audit
EnglishDeutsch · StartseiteFrançais · AccueilEspañol · InicioPortuguês (Brasil) · Início

Password Strength Checker — How Long to Crack?

Type a password to see how many possible combinations it has, how long it would take to crack, which patterns make it weaker — and, if you like, whether it appears in known data breaches. Nothing you type is sent anywhere.

Runs in your browser

Need a better one? Create it with the Advanced Password Generator.

Your data never leaves your computer. All processing happens 100% locally in your browser.

How to use the Password Strength Checker

  1. Type or paste a password. It’s analysed instantly in your browser and never sent to our server.
  2. Read the strength, the number of possible combinations and the estimated time to crack in four attack scenarios.
  3. Check the list of weaknesses — common words, sequences like “1234” or “qwerty”, years and predictable patterns.
  4. Optionally click Check data breaches to see whether the password appears in Have I Been Pwned’s database of leaked passwords.

How password strength is measured

Strength comes from how many guesses an attacker needs. For a truly random password that’s the size of the character pool raised to the power of the length: 8 random lowercase letters give 268 ≈ 209 billion possibilities, while 16 characters from all 95 printable characters give about 4.4 × 1031. Expressed in bits of entropy, every extra bit doubles the work.

Real passwords aren’t random, though. Cracking tools try leaked passwords, dictionary words, names, keyboard walks and “Word + year + !” patterns first. That’s why the checker lowers the estimate for common words, substitutions like p@ssw0rd, repeats and sequences — a long password built from a predictable pattern can be weaker than a shorter random one.

Attack scenarios

ScenarioGuesses per secondWhen it applies
Online, throttled~100 per hourLogging in to a website with rate limits or lockouts
Online, unthrottled~10Poorly protected login forms or APIs
Offline, slow hash~10,000A stolen database hashed with bcrypt, scrypt or Argon2
Offline, fast hash~100 billionA stolen database with MD5/SHA-1 hashes cracked on GPUs

Is the breach check safe?

Yes. It uses Have I Been Pwned’s k-anonymity API: your browser hashes the password with SHA-1 and sends only the first five characters of the hash. The service returns every leaked hash starting with those characters, and your browser compares them locally. Neither we nor Have I Been Pwned can see the password or the full hash.

What actually makes passwords strong

  • Length beats complexity. Aim for 16+ random characters or a passphrase of 5–6 random words.
  • Never reuse passwords. Breached passwords are tried on other sites (credential stuffing) — reuse is the biggest real-world risk.
  • Use a password manager and turn on two-factor authentication for important accounts.

Create strong passwords and passphrases with the Advanced Password Generator, and calculate possibilities for codes and PINs with the Possibility & Combination Calculator.

Tools that pair well with the Password Strength Checker

  • Random Number Generator — Generate random numbers (with or without duplicates), pick winners from a list, shuffle names, split groups into teams, flip coins and roll dice — using your browser’s cryptographically secure randomness.
  • UUID Generator — Create cryptographically random UUIDs (v4) or sortable, timestamp-based UUIDs (v7) in bulk, then copy or download them.
  • Soft Hyphen Generator — Stop long words like “Versicherungsleistungen” from overflowing on mobile: insert invisible soft hyphens automatically or at your own break points, then copy the result.
  • Smart Quotes to Straight Quotes — Code copied from Slack, Notion, Word or a blog won’t run?

Frequently asked questions

Is it safe to type my password here?
The strength analysis runs entirely in your browser; nothing is sent to devpack. The optional breach check sends only a 5-character prefix of the password’s SHA-1 hash to Have I Been Pwned (k-anonymity). Still, the safest habit is to test a similar password rather than your real one.
How long does it take to crack an 8-character password?
A random 8-character password using all character types has about 6.6 × 1015 possibilities — hours to days for a fast offline attack on GPUs. Common or patterned 8-character passwords fall in seconds. Use 12–16+ characters.
What is password entropy?
Entropy measures unpredictability in bits: each bit doubles the number of guesses needed. Around 60 bits is reasonable for most accounts, 80+ bits is strong, and 100+ bits is beyond any practical brute-force attack.
Why does my long password still look weak?
It probably contains a common word, a name, a year or a keyboard pattern. Attackers test those first, so they add far less strength than random characters.

Related tools

Password GeneratorCreate strong, truly random passwords or easy-to-type passphrases — with advanced rules: include or…Possibility & Combination CalculatorHow many possibilities are there? Enter n items and choose r to get combinations, permutations and both…Hash GeneratorCompute MD5 and SHA hashes of any text or file instantly, create HMAC signatures, and paste an expected…Random Number GeneratorGenerate random numbers (with or without duplicates), pick winners from a list, shuffle names, split…UUID GeneratorCreate cryptographically random UUIDs (v4) or sortable, timestamp-based UUIDs (v7) in bulk, then copy or…Soft Hyphen GeneratorStop long words like “Versicherungsleistungen” from overflowing on mobile: insert invisible soft hyphens…