glunty Password Strength Checker
Estimate entropy in bits, crack time, and weak spots locally. The password never leaves your browser.
- Runs in your browser
- No sign-up
- No watermark
- No installs
Your password is checked entirely on this page and never leaves your browser. Even so, never paste a real production password anywhere. Test with a sample of the same shape.
Checklist
What this tool does
Estimates how strong a password is without sending it anywhere. As you type, it works out which character classes the password uses (lowercase, uppercase, digits, symbols), computes the size of that character pool, and multiplies your password length by the base-2 logarithm of the pool to get entropy in bits. It then shows a plain strength label, an estimated offline crack time, and a checklist of common weaknesses. The check runs entirely on this page in JavaScript, so the password you type is never sent to a server, logged, or stored. As a habit, never paste a real production password into any website; test with a sample of the same shape instead.
How to use it
Type or paste a sample password into the box. Use the Show button to reveal or hide the characters. The readout updates live: the Strength line shows the label and the estimated bits (with the character pool it assumed), the meter fills toward 128 bits, and the crack-time line estimates how long an offline attacker would need. The checklist marks whether the password reaches 12 characters and includes a lowercase letter, an uppercase letter, a digit, and a symbol. A warning appears for obvious patterns such as "123456", a repeated character, or a run like "abcd".
Common use cases
- Sanity-checking the shape of a password policy before you roll it out.
- Teaching why length matters more than swapping a for @ in a short word.
- Comparing two candidate passphrases to see which carries more entropy.
- Confirming that a generated password clears a target bit count before you save it.
- Demonstrating, in a talk or class, how crack time explodes as length grows.
Common pitfalls
- Pool-based entropy is optimistic. The bit count assumes every character is random. A real word with a digit tacked on, like "Password1", is far weaker than its score suggests, because attackers guess dictionary variants first. Watch the pattern warnings.
- Crack time is an assumption, not a promise. The estimate uses 10^10 guesses per second and about half the keyspace on average. A slow, salted hash such as bcrypt makes an attacker far slower; a fast unsalted hash makes them far faster. Use the number as a guide.
- Length beats symbol soup. Adding characters raises entropy faster than cramming in exotic symbols. A long passphrase is usually both stronger and easier to type than a short dense string.
- Never paste a real secret. This tool is local and sends nothing, but paste habits are dangerous. Check a same-shape sample, not the password you actually use in production.
Frequently asked questions
- How is password strength estimated here?
- The tool measures entropy in bits using a character-pool model. It detects which character classes your password uses (lowercase adds 26, uppercase adds 26, digits add 10, symbols add about 33) and multiplies the number of characters by the base-2 logarithm of that pool size. More bits means an attacker must try more guesses. This is a deliberately simple estimate: it does not know about dictionary words or leaked-password lists, so a pattern like "Password123!" can score higher than it deserves.
- What do the strength labels mean?
- The labels are rough bands based on entropy in bits. Under 28 bits is very weak, 28 to 35 is weak, 36 to 59 is fair, 60 to 127 is strong, and 128 bits or more is very strong. For a password you actually rely on, aim for at least 60 bits and prefer more. Length is the easiest way to add bits.
- How is the crack time calculated?
- The estimate assumes an offline attacker who has your password hashes and can try about 10^10 (ten billion) guesses per second, which is a plausible rate for a fast hash on modern hardware. It also assumes the attacker must try about half of the keyspace on average before hitting the right value. Real-world speed varies enormously: a slow, salted hash such as bcrypt is far harder to attack, while a fast unsalted hash is far easier. Treat the number as an order-of-magnitude guide, not a guarantee.
- Is my password sent anywhere?
- No. Everything runs in JavaScript on your device. The password is never uploaded, logged, or stored anywhere off your machine. You can confirm it yourself: open your browser developer tools, switch to the Network tab, and type in the box. You will see zero requests. As a habit you should still never paste a real production password into any website, including this one; test with a similar-shape sample instead.
- Why can two passwords of the same length score differently?
- Because the pool size depends on which character classes appear. A 10-character all-lowercase password draws from a pool of 26, while a 10-character password that mixes uppercase, digits, and symbols draws from a pool of about 95. The larger pool means more bits per character, so the mixed password scores higher even at the same length.
- What does the common-pattern warning check?
- It flags a few obvious weaknesses that the pool-based entropy score cannot see: exact matches against a short list of the most common passwords (such as "password" or "123456"), a single character repeated three or more times in a row, and simple sequences like "1234" or "abcd". These patterns are the first things a real cracking tool tries, so any password that trips a warning is weaker than its bit count suggests.
Cite this tool
For academic, journalistic, or technical references. Pick a format:
Citations use 2026 as the publication year. Access date is left as a fillable placeholder where the citation style expects one.