Password Crack Time Estimator
Estimate how long your password takes to crack under 4 attacker scenarios, with zxcvbn-style pattern detection and a local passphrase generator. Nothing is uploaded.
How to use this tool
- Type your password — use the Show button to reveal it if you want.
- Watch the score, entropy, and detected weaknesses update live.
- Compare the estimated crack time across the four attacker scenarios.
- Click Suggest a strong passphrase to generate a secure one locally.
password-crack-time goes beyond a colored strength bar. It estimates entropy with a lightweight, zxcvbn-style pattern detector implemented from scratch: it penalizes dictionary words, ascending/descending sequences (abc, 123), keyboard runs (qwerty), repeated characters, embedded dates and years, and common leetspeak substitutions. Then it shows how long the password would survive under four realistic attacker scenarios — from a throttled online login to an offline GPU cracking a fast hash — plus a 0–4 score and concrete advice.
One click generates a strong, memorable passphrase locally using your browser's cryptographically secure random generator. This tool is for anyone who wants to know whether their password is actually safe.
Privacy by design: your password is never stored, never sent over the network, and never placed in the URL. Every calculation happens on your device.
How it works
The Password Crack Time Estimator calculates how long a password would take to crack under four realistic attacker scenarios: an online throttled attack, an offline slow-hash attack, an offline fast-hash attack, and a massive GPU cluster attack. Time estimates range from milliseconds to centuries depending on password strength.
The tool also performs pattern detection similar to the zxcvbn library, recognizing common words, keyboard walks (qwerty, 12345), dates, and repeated characters that make a password weaker than its length suggests.
A built-in passphrase generator suggests a random word sequence that achieves high entropy with less memorization effort. All analysis happens locally in your browser — your password is never transmitted to any server.
Worked example
Test a common password vs a passphrase
- Type Password123! into the input field.
- Note the crack time — likely seconds to minutes for fast offline attacks due to common patterns.
- Click Generate Passphrase to get a suggestion like correct-horse-battery-staple.
- Compare the crack time — the passphrase should show years or centuries even for fast attacks.
The passphrase demonstrates that length and randomness beat complexity tricks.
Common mistakes to avoid
- Assuming that adding ! or 1 to the end of a word makes it strong — pattern detectors and cracking wordlists account for this.
- Trusting the online-attack crack time as your security baseline — if a site is breached, the attacker works offline at GPU speed.
- Using the generated passphrase as-is across multiple accounts — each account should have a unique password.
Key terms
- Entropy
- A measure of password unpredictability in bits; each additional bit doubles the number of guesses required to crack it.
- Offline attack
- A scenario where an attacker has obtained a leaked password hash and can test billions of guesses per second on local hardware without network throttling.
- Keyboard walk
- A password formed by pressing adjacent keyboard keys in sequence (e.g. qwerty, 1q2w3e), which attackers test early in dictionary attacks.
Frequently asked questions
- Is my password sent anywhere?
- No. Unlike most tools on this site, this one deliberately does not sync to the URL and uses no storage. All entropy analysis and crack-time math run in JavaScript on your device. Nothing about your password leaves the input box.
- Why show multiple crack-time scenarios?
- A single number is misleading. The same password resists a throttled online login (~100 guesses/second) for far longer than an offline attacker with a GPU running billions of guesses/second against a fast hash. Seeing all four scenarios reflects real-world risk far better.
- How is the strength score calculated?
- We estimate raw entropy from length and character-set size, then subtract penalty bits for detected patterns (common words, sequences, keyboard runs, repeats, dates). The resulting bit estimate maps to a 0–4 score, similar in spirit to Dropbox's zxcvbn.