Free tool

See how long a password survives

Entropy, character composition, predictable patterns, and the common-password corpus — scored into an estimated crack time. Every calculation runs in your browser; the password never leaves your device.

01Composition

02Patterns

03Entropy

04Crack time

05Common corpus

100% Client-Side - Your password never leaves your browser

Your password is analyzed locally and never sent to any server.

6Analysis Categories

200+Common Passwords

0Data Sent

InstantResults

Estimated Crack Times

Estimates

Passwords are just the first layer

Protect Your Entire Application

Strong passwords matter, but your web application needs comprehensive security testing to catch authentication bypasses, session flaws, brute-force vulnerabilities and more.

Try the Lory AI Pentester Book a Consultation

Usage-based pricing Human-reviewed findings No subscription

Generate a Secure Password

Length: 16

Uppercase Lowercase Numbers Symbols

What We Check

Comprehensive Password Analysis

Our checker evaluates your password across multiple dimensions to give you a complete security picture.

Character Composition

Analyzes length, character types (uppercase, lowercase, numbers, symbols), and overall variety.

Pattern Detection

Detects sequential characters, keyboard patterns, repeated characters, and leet speak substitutions.

Entropy Calculation

Computes bits of entropy based on character pool size and password length for a mathematical strength measure.

Crack Time Estimation

Estimates how long it would take to crack your password under various attack scenarios from online to GPU clusters.

Common Password Database

Checks against 200+ of the most commonly used passwords and their variations to flag easily guessable choices.

Smart Recommendations

Provides specific, actionable tips tailored to your password's weaknesses to help you create a stronger one.

Frequently Asked Questions

Is my password sent to a server?

No, absolutely not. This tool runs 100% in your browser using JavaScript. Your password never leaves your device and is never transmitted over the network. You can verify this by disconnecting from the internet - it will still work.

How is crack time calculated?

Crack time is based on entropy. We determine the character pool size, calculate total combinations (pool_size ^ length), then divide by attack speed: 1,000/s online, 10 billion/s offline, 1 trillion/s GPU cluster. The result is halved on average.

What makes a strong password?

At least 12 characters (16+ is better), mix of uppercase, lowercase, numbers, and symbols, no dictionary words or common phrases, no personal info, no predictable patterns. Consider a passphrase - random words strung together.

Should I use a password manager?

Yes. A password manager generates unique, strong passwords for every account and stores them securely. Popular options include Bitwarden (open source), 1Password, and KeePass. This eliminates password reuse - one of the biggest security risks.

How often should I change passwords?

Modern guidance (NIST SP 800-63B) no longer recommends regular rotation unless compromised. Focus on strong, unique passwords and enable MFA everywhere. Change immediately if you suspect a compromise or a service reports a breach.

Stop Guessing. Start Monitoring.

Strong passwords are just the beginning. The Lory AI Pentester tests your in-scope assets continuously, and a human pentester signs off on every finding.

Try the Lory AI Pentester Book Consultation

Usage-based — pay for what you run Prepaid credits, 1 credit = $1 No subscription