Orpheus

How Strong Is This Password?

Entropy in bits, and the patterns that undo it.

Options
Explain each finding
Result

Everything is processed in this tab. Nothing you paste is sent anywhere.

Every tool runs entirely in your browser. Your files are never uploaded to a server.

Strength is entropy: the log base two of the alphabet size times the length. Patterns reduce it — a dictionary word with numbers substituted for letters is worth barely more than the word.

How to use Password Strength Checker

  1. Type or paste a password. Nothing is transmitted; the check runs in your browser.
  2. Read the entropy figure. In bits, with an estimated offline cracking time.
  3. Read the findings. Each one is a reason the real strength is below the naive figure.

About checking password strength

Password strength is measured as entropy, the number of bits needed to describe how many candidates an attacker must work through. The naive calculation multiplies the length by the log base two of the alphabet size, which gives an upper bound on strength — the figure a password would have if every character were chosen at random. Almost no password chosen by a person reaches it. What closes the gap is structure. Attackers do not brute-force blindly; they run dictionaries through rule sets that apply the transformations people actually use, and those rules are derived from analysing hundreds of millions of leaked passwords. Substituting a zero for an o, capitalising the first letter, appending a year, adding an exclamation mark — each of these feels like added difficulty and costs an attacker close to nothing, because they are the first mutations tried. A dictionary word dressed up this way is worth barely more than the bare word. This is also why the shape of a password matters as much as its contents. Capital letter, lowercase word, two to four digits, optional punctuation is the single most common structure in every published corpus, and a candidate matching it is found long before an equally long random string. Length remains the property that helps most, because each additional character multiplies the space by the full alphabet size while adding symbols multiplies it only once. And no strength figure addresses the risk that actually compromises accounts, which is reuse: a perfect password used in two places is compromised the moment either is breached.

Frequently asked questions

Is it safe to type a real password here?
The check runs entirely in your browser and nothing is transmitted or stored. Even so, typing a live password into any web page is a habit worth not building — the safer use is checking the shape of a password you are considering.
What is entropy in bits?
A measure of how many guesses an attacker needs. Each bit doubles the search space, so 40 bits is about a trillion possibilities and 60 bits is about a million times more. It is calculated as the log base two of the alphabet size multiplied by the length.
Why is P@ssw0rd rated so badly?
Because every cracking tool applies those substitutions as a standard rule before looking a candidate up. The at-sign becomes an a and the zero becomes an o, and what remains is the most common password ever leaked. The transformation costs an attacker essentially no time.
Why does the cracking time assume a fast hash?
Because it is the pessimistic case and the one worth planning for. A password stored with bcrypt or Argon2 takes vastly longer to attack, but you cannot know how a service stores yours — assuming the weakest reasonable choice is the only safe assumption.
Should I trust any strength meter?
Treat them as directional. A meter cannot know whether your password appears in a breach corpus, whether it is a phrase from a book, or whether you have used it elsewhere — and reuse is what actually compromises most accounts, regardless of strength.

Last updated