Inspectors

Password Strength Estimator

Enter a password and get an instant strength assessment. The tool estimates the entropy (in bits), identifies weaknesses (common patterns, dictionary words, repeated characters), and estimates the time to crack using different attack methods. All analysis is local — your password never leaves your machine.

Password Strength — Estimate password entropy, weaknesses and crack time

What it does

  • ▸Estimates password entropy in bits based on character set and length
  • ▸Identifies weaknesses: common patterns, repeated characters, sequences
  • ▸Detects dictionary words and common password patterns
  • ▸Estimates crack time for different attack speeds (online, offline, GPU)
  • ▸Shows a strength meter from weak to very strong
  • ▸All processing is local — no network transmission

Use cases

  • ▸Testing the strength of a password before using it
  • ▸Evaluating password requirements for a new application
  • ▸Demonstrating why common passwords are weak
  • ▸Comparing the strength of different password strategies

How it works

1

Type or paste a password into the input field

2

The tool analyzes character variety, length, and patterns

3

Entropy is calculated and crack time is estimated

4

Weaknesses are listed with recommendations

Frequently asked questions

1How is entropy calculated?

Entropy is calculated as log2(charset_size^length). A password using lowercase, uppercase, digits, and symbols has a charset of ~95 characters. A 12-character password from this charset has log2(95^12) ≈ 78.6 bits of entropy. Higher entropy means more possible combinations to try.

2Are the crack time estimates accurate?

They're estimates based on assumed attack speeds. Online attacks (via a web login) are typically throttled to 100-1000 guesses/second. Offline attacks (against a stolen hash) can be billions of guesses/second with GPUs. The estimates show the worst-case scenario for a stolen hash.

3Is it safe to type my real password?

Yes. The analysis runs entirely in the app — no data is sent to any server. However, if you're concerned, use a test password with similar characteristics (same length, same character types) to get an estimate without entering your actual password.

Related tools

Bcrypt Hash/Verify — Hash text with bcrypt or verify text against a bcrypt hash

Bcrypt Hash/Verify

Hash text with bcrypt or verify text against a bcrypt hash

Random String Generator — Generate cryptographically random strings and passwords

Random String Generator

Generate cryptographically random strings and passwords

Stateless Password Generator — Derive deterministic passwords from a master secret and site name — same inputs always produce the same password

Stateless Password Generator

Derive deterministic passwords from a master secret and site name — same inputs always produce the same password

Hash Generator — MD5 / SHA / CRC32 / Blake hashes and HMACs of the input text

Hash Generator

MD5 / SHA / CRC32 / Blake hashes and HMACs of the input text

Use Password Strength offline in Devinity

All 95 tools run locally on your Mac. No internet required, no data sent to servers.

Download Devinity →