Password Strength Checker

No. Every check — length, character variety, entropy, pattern detection, and crack-time estimation — runs entirely in your browser using JavaScript. Nothing is sent to PrivacyTestLab servers, logged, or stored. The only network request this tool makes is the optional breach database check, and that request never contains your actual password — see the next question for exactly how that works.

This tool uses the Have I Been Pwned k-anonymity API. Your password is hashed locally with SHA-1, and only the first 5 characters of that hash are sent over the network. HIBP responds with every breached password suffix that shares those first 5 characters — often hundreds of them — and your browser checks locally whether your full hash appears in that list. The server never sees your password or your full hash, only an ambiguous 5-character prefix shared by many thousands of unrelated passwords.

Entropy, measured in bits, estimates how many guesses a brute-force attacker needs on average before finding your password, calculated as log2(keyspace^length). Each additional bit doubles the search space. 40 bits is trivial for modern hardware, 60 bits is solid for most personal accounts, and 80+ bits is effectively unbreakable by brute force with current technology. Entropy alone can overstate real-world strength, though — it assumes truly random characters and doesn't account for dictionary words or known patterns, which is why this tool also runs separate pattern detection.

Keyspace grows exponentially with length but only linearly with character-set size. Adding a single extra character to a random password multiplies the total keyspace by the size of your character set, while adding one more character class (say, symbols on top of letters and digits) only multiplies each position by a small constant. In practice, a 16-character lowercase-only passphrase is harder to brute-force than an 8-character password using all four character classes.

Reputable password managers encrypt your vault locally before it ever leaves your device, using a zero-knowledge architecture — the provider cannot read your stored passwords even if their servers are breached, which has happened to more than one major provider without vault contents being exposed. The real risk is a weak or reused master password, since that single password is what everything else depends on. Use a long, unique passphrase for your master password and enable two-factor authentication on the vault itself.

Crack time depends entirely on how the destination site stored your password, not just on the password itself. Against a fast, unsalted hash like raw MD5 or SHA-1, modern GPU hardware can attempt tens of billions of guesses per second. Against a properly salted, deliberately slow algorithm like bcrypt or Argon2, the same hardware might manage only tens of thousands of guesses per second — a difference of five to six orders of magnitude for the identical password. Since you never know which one a given site uses, treat the faster, more conservative estimate as the one that matters.