Password Strength & Entropy Meter
Test your password's brute-force resistance against standard attacks vs 600,000 PBKDF2 iterations.
How this calculator works
Most strength meters hand you a vague colour bar. This one shows the actual number it is reasoning about, so you can check the arithmetic yourself. The calculation has two steps.
Step one: measure the search space. The tool inspects which character classes your password draws on and adds up the corresponding alphabet sizes — lowercase adds 26, uppercase adds 26, digits add 10, and symbols add 32. That total is the pool. A password using lowercase, uppercase and digits has a pool of 62 possible characters in every position.
A 16-character password over a 62-character pool works out to 16 × log₂(62) ≈ 95 bits. Each additional bit doubles the number of guesses an attacker must make, which is why length moves the needle far more than sprinkling in punctuation. Going from 12 to 20 characters buys you more than adding a single ! to the end ever will.
Step two: convert bits into time. The tool assumes a well-funded attacker running roughly 10 billion guesses per second — a realistic figure for a rented multi-GPU rig attacking a fast, unsalted hash such as MD5 or SHA-1. That produces the left-hand number. The right-hand number divides that rate by 600,000 to model what happens when the same password is stretched through PBKDF2 at Locksy's iteration count.
That division is the entire point of key stretching. The attacker's hardware has not changed; the cost of testing a single candidate has. Six hundred thousand rounds of HMAC-SHA-256 makes each guess about 600,000 times more expensive, which turns an afternoon into a geological era without you having to memorise a longer password.
How to read your result
The four bands below are the exact thresholds the meter uses. They are deliberately conservative: a password scoring “Strong” here is comfortably beyond what opportunistic attacks will chew through.
Very Weak — under 30 bits
entropy < 30Falls in minutes to a laptop, never mind a GPU. Short passwords and anything containing a recognisable dictionary word land here. Do not use one of these as a master password — it is the single key protecting everything else.
Moderate — 30 to 54 bits
30 ≤ entropy < 55Survives casual guessing but not a targeted, funded attempt. Acceptable for a throwaway forum login. Not acceptable for email, banking, or anything that can be used to reset other accounts.
Strong — 55 to 79 bits
55 ≤ entropy < 80The sensible target for everyday accounts. Brute force stops being the cheapest way in, which means an attacker will switch to phishing or malware instead — a useful sign that your password is no longer the weak link.
Maximum — 80 bits and above
entropy ≥ 80Brute force is off the table for the foreseeable future, even before key stretching is applied. Aim here for a master password. A four or five word passphrase reaches this range easily and is far easier to type than random characters.
Workstation exposure audit
A perfect password protects the moment you log in. It does nothing about the hours afterwards, when the session is already open and authenticated on your screen. Tick whatever describes your setup to see how exposed your logged-in tabs are.
This score is a self-assessment aid, not a scan. It weights the answers you gave — unattended tabs cost the most, a missing auto-lock timer next — and nothing is transmitted anywhere.
Tips for Creating Strong Passwords
Length is Your Best Defense
Every additional character drastically increases the number of combinations an attacker must test. Aim for at least 16 characters for critical master passwords.
Consider Using a Passphrase
Combining 4 to 5 random words creates a password that is virtually impossible to brute-force while remaining significantly easier to remember and type.
Avoid Common Patterns and Personal Info
Never use dictionary words, birthdates, predictable replacements (such as @ for a), or repeated sequences that automated password crackers test first.
Frequently Asked Questions
Is it safe to test my password here?
Yes. Calculations run locally inside your browser memory. Your password is never sent across the internet, saved, or logged.
Why is length better than adding symbols?
Length exponentially multiplies the total search space, whereas adding a symbol only slightly increases the pool of characters.
What is PBKDF2 encryption?
PBKDF2 is an industry-standard key stretching function that makes brute-force guessing attacks exponentially slower and computationally expensive for attackers.
Protect Open Tabs with Locksy
Lock and encrypt active browser tabs with PBKDF2 encryption, master password security, and biometric unlock.
Get for Chrome
Get for Firefox
Get for Edge