Password Strength Checker NZ
This tool estimates how strong a password is, calculating its entropy in bits, giving it a strength rating, and estimating how long it would take to crack by brute force. A strong password is your first line of defence for online accounts, yet many people rely on passwords that are far weaker than they realise. Strength comes down to two things: how long the password is, and how large a pool of characters it draws from. A short password, or one using only lowercase letters, has relatively few possible combinations and can be guessed quickly by a computer. A long password mixing uppercase and lowercase letters, digits and symbols has astronomically more possibilities, pushing the time to crack it from seconds into millions of years. This is captured by entropy, measured in bits, where each extra bit doubles the number of possibilities. This tool calculates it for you. You type a password, and the checker works out the size of the character pool it uses, computes the entropy from that and the length, assigns a rating from very weak to very strong, and estimates the brute-force crack time assuming a fast attacker. Crucially, everything runs in your browser and nothing is ever sent anywhere, so it is safe to test. The result updates as you type. Use it to judge your passwords, to understand what makes one strong, or to help choose a better one. A few principles: length matters more than complexity, so a long passphrase beats a short jumble; avoid dictionary words and common patterns, which real attackers try first; and use a unique password for every account, ideally with a password manager.
Entropy = length x log2(character pool size). Crack time assumes 10 billion guesses per second. Tested entirely in your browser; nothing is sent anywhere.
How it works
The tool inspects which character types the password uses, lowercase, uppercase, digits and symbols, and adds up the size of that combined pool. The entropy is the password length times the base-2 logarithm of the pool size. The crack time divides the total number of possible combinations by an assumed fast guessing rate.
Worked example
The password P@ssw0rd123 is 11 characters and uses lowercase, uppercase, digits and symbols, a pool of about 95 characters. Its entropy is 11 times the log base 2 of 95, about 72 bits, rated strong. At 10 billion guesses a second, brute-forcing it would still take an impractically long time, though real attackers would try common patterns first.
Related calculators
- Password Generator: create strong passwords.
- Hash Generator: hash text.
- UUID Generator: unique identifiers.
- Random Number Generator: random numbers.