Password Strength Meter

This meter goes beyond simple rule-checking (uppercase / digit / symbol). It uses zxcvbn (Dropbox's password strength estimator, the same engine behind 1Password and Dropbox) to recognise realistic attacker patterns, then reports three signals:

• Shannon entropy — a naive measure: log2(character-set size) × length.
• Effective entropy — derived from zxcvbn's estimated guess count (log2 guesses), which accounts for real-world patterns. A password like Password123! scores high on Shannon entropy but low here, because zxcvbn sees the dictionary word.
• Crack time — guesses ÷ attack speed, computed for the scenario you select: offline fast hash (10¹⁰/s, e.g. leaked bcrypt-rigged GPU), offline slow hash (10⁴/s, properly-configured bcrypt/argon2), or online attack (100/s, login form rate-limited).

Use cases: sanity-check a password before adoption, teach why "complex but predictable" passwords fail, compare candidates, or demonstrate to a team why a policy that merely requires length+symbol is insufficient.

The password never leaves this request.