Password Strength Checker: Frequently Asked Questions

No. The checker runs entirely in your browser using JavaScript. Your password is never transmitted to any server, stored in any log, or shared with anyone. You can verify this by disconnecting your internet and testing — it works perfectly offline.

It is one of the most commonly used passwords in the world and appears in every attacker's dictionary. Regardless of its theoretical character entropy, it would be cracked in under a second in any real attack.

For most purposes, a crack time of 'centuries' or 'millions of years' against offline attacks is more than sufficient. Remember that attackers also have to target you specifically — most breached databases contain millions of accounts and attackers prioritise the weakest passwords first.

Long passwords can still score poorly if they consist of repeated characters, dictionary words, keyboard patterns, or common phrases. Entropy is calculated from the effective randomness, not just the length.

Entropy is a mathematical measure of randomness based on length and character set. The score (0–100) combines entropy with pattern analysis, common password checks, and composition analysis — it is more holistic and may penalise passwords that have high mathematical entropy but are predictable in practice.

Online attacks (trying passwords at a login form) are limited by rate throttling, CAPTCHAs, and account lockouts. Even a relatively weak password is practically resistant to online attacks. The main concern is offline attacks after a database breach — which is why unique passwords per account matter so much.

bcrypt, scrypt, or Argon2 are the current recommendations. These are intentionally slow hashing algorithms that make offline cracking dramatically harder. MD5 and SHA-1 password hashes are dangerously fast to crack and should not be used for passwords.