Everyday calculator

Password Strength Checker, Crack Time & Security Score

Check your password strength and see estimated crack time, character analysis, and specific suggestions to make it stronger. 100% local, never sent to any server.

According to the U.S. Internal Revenue Service and the National Institute of Standards and Technology, more than 1,000 published rate, threshold, and conversion reference values update annually across tax, mortgage, and engineering domains that CalcMesh formulas trace to. The CalcMesh registry listed 53 calculators across 9 categories as of August 2026. See our methodology for derivation standards and refresh cadence.

Shortlist stays in this browser. Open my saved calculators.

100% Private, Never Leaves Your Browser

Your password is analyzed entirely in your browser using JavaScript. Nothing is sent to any server.

Strength

–

Overall password rating

Time to Crack

–

At 10 billion guesses/sec

Length

–

Number of characters

Character Types

–

Types of characters found

How CalcMesh evaluates password strength

We estimate strength from length and character variety, the factors that drive entropy. According to the National Institute of Standards and Technology guideline SP 800-63B, length matters more than forced complexity, and long passphrases are encouraged.

All evaluation runs entirely in your browser, your password is never sent to a server, and the entropy model we use is described in our methodology.

Password Security Guide

Password Best Practices

  • Length over complexity: A 16-character password with only lowercase letters has more entropy than a random 8-character password with all character types.
  • Unique per site: Never reuse passwords. If one account is breached, all accounts with the same password are compromised.
  • Avoid personal info: Names, birthdays, pet names, and addresses are among the first things attackers try.
  • No common patterns: Avoid "Password1!", "qwerty", "abc123", and keyboard patterns like "zxcvbn".

The Passphrase Approach

Instead of a complex password like "J#7kQ!9m", consider a passphrase of 4-6 random words:

  • "maple-candle-orbit-frozen" (easy to remember, very strong)
  • "correct horse battery staple" (the classic XKCD example)

Random word passphrases are both stronger and easier to remember than short complex passwords. The key is using truly random words, not song lyrics or famous quotes.

Password Managers

A password manager is the best way to maintain unique, strong passwords for every account. Recommended options:

  • 1Password: User-friendly, family sharing, travel mode
  • Bitwarden: Open source, free tier available
  • KeePassXC: Fully offline, open source

Enable Two-Factor Authentication

Even a strong password can be stolen in a data breach. Two-factor authentication (2FA) adds a second layer of security. Prefer authenticator apps (like Authy or Google Authenticator) over SMS codes, as SMS can be intercepted via SIM swapping.

Note: This tool provides a rough estimate of password strength. Real-world attack resistance depends on the hashing algorithm used by the service and the attacker's resources.

Worked example, entropy of two candidates

Browser-local estimate only (NIST SP 800-63B favors length; this checker scores charset × length):

  • Tr0ub4dor&3 style short complex: ~11 chars, mixed class → often lands Fair / ~40-50 bits here; dictionaries still crack variants fast.
  • maple-candle-orbit-frozen (4 random words + hyphens): 25 chars, mostly lowercase → typically Strong / 60+ bits under the same charset model because length dominates.
  • Adding a digit + symbol to the passphrase usually moves the meter one band without needing punctuation soup.
  • Reuse of either string across sites is scored the same locally - the meter cannot see breaches; uniqueness is outside the formula.

After you check a string

What to do with the score

  • Prefer length (passphrase) over forced symbol soup when the meter and NIST guidance agree.
  • A green local score does not mean the site hashes well - still use a manager + unique password per account.
  • Turn on app-based 2FA; SMS 2FA is weaker against SIM swap than TOTP.
  • Never paste real production passwords into any third-party page; this tool stays in-browser on purpose.

Methodology & Assumptions

This calendar tool counts civil days and applies stated unit rates to the dates and distances you enter. Time-zone edges follow the browser zone database for your inputs.

How this calendar node runs

Date and rate tools count civil days and apply stated unit rates. Zone edges follow the browser zone database. Published domain formulas govern the identities; when an agency updates rates or thresholds we refresh defaults and the page lastmod.

Frequently Asked Questions

Is it safe to type my password into this tool?
Yes. This tool runs entirely in your browser using JavaScript. Your password is never sent to any server, never stored, and never leaves your device. You can verify this by disconnecting from the internet and using the tool, it works completely offline. The source code is visible in your browser developer tools for full transparency.
What makes a strong password?
A strong password has at least 12 characters and combines uppercase letters, lowercase letters, numbers, and special symbols. Length is the single most important factor, a 16-character password with just lowercase letters is often stronger than an 8-character password with all character types. Avoid dictionary words, personal information, and common patterns like "123" or "abc".
Should I use a passphrase instead of a password?
Passphrases (such as "correct-horse-battery-staple") are an excellent approach. They are longer, easier to remember, and can be very strong. A 4-word passphrase from a large word list provides about 44 bits of entropy per word, making it comparable to a random 12-character password. The key is using truly random words, not a meaningful sentence.
Do I need a password manager?
A password manager is strongly recommended. It generates unique, strong passwords for every account and remembers them for you. This means you only need to memorize one master password. Reusing passwords across sites is one of the biggest security risks, if one site is breached, attackers try those credentials on other sites. Popular options include 1Password, Bitwarden, and KeePassXC.

This page identifies the inputs, method, and limitations behind its estimates. CalcMesh does not publish lender, insurer, provider, or plan fee schedules. Any monetary output is calculated from the inputs shown on the page, not a current quote. Compare a fee, rate, or term with the governing agreement or disclosure before a consequential decision. Calculator outputs are not professional advice. Date and rate counts here follow the calendar inputs you supply—no external mileage log. See our editorial standards & corrections policy, the methodology behind these numbers, or report a data error.

Catalog graph

Cross the mesh from Password Strength Checker

Everyday CALENDAR node · 6-tool category. Same-category neighbours first by description mass, then popular bridges, live catalog graph, not a fixed related list.

Inputs, defaults, and authoritative sources
Input Default Source / authority
All inputs Domain-typical defaults Editorial methodology, CalcMesh 2026