Password Strength Checker
Estimate a password's entropy and how long it would take to crack against a fast hash and against bcrypt, with the patterns that weaken it.
Free · No sign-up · Your inputs stay in your browser
Input
Check how strong a password is
Output
Strong
Estimated entropy
72 bits
Length / charset
11 / 95
Fast hash offline (10 billion guesses/s)
9,012 years
An unsalted MD5 or SHA-1 dump on one modern GPU rig.
bcrypt, cost 10 (10,000 guesses/s)
9 billion years
What Laravel's Hash::make() uses by default.
NIST SP 800-63B asks for at least 8 characters and recommends allowing 64; 12 or more is a sensible floor for anything that matters.
An estimate, not a guarantee: entropy from length and character set, minus penalties for patterns crackers try first. A random passphrase of four or five words, or a password manager's 20 random characters, beats any clever substitution.
Runs in this browser. Nothing you paste is sent to a server.
About this tool
Method, assumptions, practical next steps, and limits.
Length beats complexity
NIST SP 800-63B tells services to require length, allow at least 64 characters and stop imposing composition rules, because rules produce predictable passwords like Summer2026!. Four or five random words, or a password manager's random string, are stronger and easier to handle.
The hash decides the speed
The same password survives seconds against an unsalted MD5 dump and decades against bcrypt or Argon2, which is why storage matters as much as the password. Laravel's Hash::make() uses bcrypt by default; checking new passwords against known breaches is one rule away with Password::min(12)->uncompromised().