# Password Strength Meter

Estimate real password strength with Shannon entropy, zxcvbn pattern matching (l33t, dictionary, sequences, repeats) and brute-force crack-time across attack scenarios (offline fast/slow hash, online). The password is evaluated locally and never sent anywhere.

> Canonical page: https://elysiatools.com/en/tools/password-strength-meter

- **Category:** Security

- **Keywords:** password, strength, entropy, zxcvbn, crack time, brute force, security, password strength, estimate, password meter

## Overview

This meter goes beyond simple rule-checking (uppercase / digit / symbol). It uses **zxcvbn** (Dropbox's password strength estimator, the same engine behind 1Password and Dropbox) to recognise realistic attacker patterns, then reports three signals:

- **Shannon entropy** — a naive measure: log2(character-set size) × length.
- **Effective entropy** — derived from zxcvbn's estimated guess count (log2 guesses), which accounts for real-world patterns. A password like `Password123!` scores high on Shannon entropy but low here, because zxcvbn sees the dictionary word.
- **Crack time** — guesses ÷ attack speed, computed for the scenario you select: offline fast hash (10¹⁰/s, e.g. leaked bcrypt-rigged GPU), offline slow hash (10⁴/s, properly-configured bcrypt/argon2), or online attack (100/s, login form rate-limited).

Use cases: sanity-check a password before adoption, teach why "complex but predictable" passwords fail, compare candidates, or demonstrate to a team why a policy that merely requires length+symbol is insufficient.

The password never leaves this request.

## Inputs

- **Password** (text): Type a password to evaluate…
- **Attack scenario** (select)
- **Show pattern breakdown** (checkbox)

## When to use

- When creating a new account credential and wanting to ensure it resists modern dictionary and pattern-matching attacks.
- When auditing existing passwords to identify those that meet basic complexity rules but remain highly predictable.
- When demonstrating to security teams or users why simple character-replacement rules do not guarantee safety.

## How it works

- Input your candidate password into the text field to initiate local evaluation.
- The tool calculates naive Shannon entropy alongside zxcvbn-based effective entropy to identify dictionary words, sequences, and substitutions.
- Select an attack scenario—such as offline fast hash, offline slow hash, or online rate-limited attack—to calculate the estimated time required to crack the password.
- Review the detailed pattern breakdown to see exactly which parts of the password are flagged as weak or predictable.

## Use cases

- Testing a proposed master password for a password manager to ensure maximum resistance to offline brute-force attacks.
- Educating employees on why length and randomness are superior to complex but predictable character substitutions.
- Comparing multiple password candidates to select the one with the highest effective entropy and longest crack time.

## Frequently asked questions

### Is my password sent to a server for evaluation?

No. The password is evaluated entirely in your browser using local JavaScript and is never transmitted over the network.

### What is the difference between Shannon entropy and effective entropy?

Shannon entropy measures character randomness, while effective entropy uses zxcvbn to account for common patterns, dictionary words, and predictable sequences.

### What does the offline fast hash scenario represent?

It simulates an attacker who has obtained a database leak and is cracking hashes using high-speed GPU rigs at 10 billion guesses per second.

### Why does a password with numbers and symbols still get a low score?

If the password uses common patterns (like 'Password123!'), pattern-matching algorithms easily recognize the base word and common substitutions, lowering its real-world strength.

### What is zxcvbn?

It is a realistic password strength estimator developed by Dropbox that models how attackers guess passwords using dictionaries, keyboard patterns, and l33t speak.

## Related tools

- [Entropy Calculator](https://elysiatools.com/en/tools/entropy-calculator): Measure the randomness of any data — Shannon entropy (bits/symbol), Min-Entropy (worst-case guess work), alphabet size, duplicate rate, and an average brute-force cracking time at a chosen hash rate. Rates data as Strong (≥128-bit min-entropy), Medium (64-127), or Weak (<64).
- [HMAC Generator & Verifier](https://elysiatools.com/en/tools/hmac-generator-verifier): Compute an HMAC message-authentication signature over a message + shared secret using SHA-1/SHA-2/SHA-3/BLAKE2, or verify an incoming signature against the secret — with webhook presets for Stripe / Slack / GitHub and constant-time comparison
- [PKCE Code Verifier & Challenge Generator](https://elysiatools.com/en/tools/pkce-code-verifier-generator): Generate, validate and verify OAuth2 / OIDC PKCE (RFC 7636) code_verifier and S256 code_challenge pairs. Three modes: (1) generate a fresh verifier + challenge from cryptographically secure random bytes at 256/384/512/768-bit entropy, (2) audit a verifier you already have against the RFC — length (43–128), charset \[A-Za-z0-9-._~\] and ≥256-bit entropy, and (3) verify a verifier/challenge pair by recomputing BASE64URL(SHA256(verifier)). Optionally build the full authorization-request URL and token-exchange body. Complements the generic nonce-generator (which only emits a verifier+challenge pair) with RFC-compliance auditing and pair verification.
- [RSA Encrypt / Decrypt](https://elysiatools.com/en/tools/rsa-encrypt-decrypt): Encrypt text with an RSA public key or decrypt ciphertext with the matching private key, using OAEP padding (SHA-1 or SHA-256). Handles long messages by chunking. Keys and data stay local. PKCS#1 v1.5 is intentionally not offered (Node disables it for decryption due to Bleichenbacher attacks).
- [TOTP / HOTP Offline Code Generator](https://elysiatools.com/en/tools/totp-hotp-offline-generator): Generate RFC 6238 TOTP (time-based, 6/8 digits, 30/60s step) and RFC 4226 HOTP (counter-based) one-time passwords from a base32 shared secret, fully offline with HMAC-SHA1/256/512, plus an otpauth:// URI for importing into Google Authenticator / Authy
- [Argon2 Password Hash Generator](https://elysiatools.com/en/tools/argon2-password-hash-generator): Generate Argon2id password hashes with tunable memory, iterations, parallelism, salt length, and PHC output
- [Data Append Merger](https://elysiatools.com/en/tools/data-append-merger): Vertically append and merge multiple data tables with intelligent column matching
- [URL Parameter Builder](https://elysiatools.com/en/tools/url-parameter-builder): Build and construct URLs with parameters by adding query strings, hash fragments, and path segments

## Samples

- [Strong Password Samples](https://elysiatools.com/en/samples/strong-password): Collection of passwords with varying strength levels for testing password validation
- [Android Image Processing Java Samples](https://elysiatools.com/en/samples/android-image-processing-java): Android Java image processing examples including reading/saving images, scaling, and format conversion
- [Android Image Processing Kotlin Samples](https://elysiatools.com/en/samples/android-image-processing-kotlin): Android Kotlin image processing examples including reading/saving images, scaling, and format conversion
- [Web Image Processing Python Samples](https://elysiatools.com/en/samples/web-image-processing-python): Web Python image processing examples using PIL/Pillow including reading, saving, resizing, and format conversion