How Long It Takes to Crack Your Password (The Math Behind the Score)
Password cracking is a search problem. An attacker iterates through every possible combination until they find yours. The time that takes depends on two variables: the size of the search space — how many possible passwords exist at your chosen length and character set — and the attack speed in guesses per second. Both are calculable, which means crack time is calculable.
Search space scales multiplicatively with each added character type. An 8-character lowercase password draws from an alphabet of 26 characters: 26⁸ = approximately 208 billion possibilities. Add uppercase letters (52-character alphabet): 52⁸ = approximately 53 trillion. Add digits (62-character alphabet): 62⁸ = approximately 218 trillion. Add symbols to reach the full 95-character printable ASCII set: 95⁸ = approximately 6.6 quadrillion. Each character type you add multiplies the per-position search space.
But length dominates complexity. A 12-character lowercase password has a search space of 26¹² = approximately 95 quadrillion — larger than a fully complex 8-character password at 95⁸ = 6.6 quadrillion. Two thirds the complexity, 50% longer, 14 times more search space. This is the mathematical argument behind allocating 40 of 100 possible points to length.
Attack speeds vary by the hashing algorithm protecting the stored password. Against unsalted MD5 — still found in legacy systems — a modern GPU cluster tests roughly 10 billion hashes per second. Practical timescales at that rate: an 8-character lowercase password falls in 21 seconds. An 8-character fully complex password takes about 11 minutes. A 12-character lowercase password requires approximately 5 years. A 12-character fully complex password takes around 21,000 years. A 16-character lowercase password exceeds 900,000 years. Against bcrypt (30,000 guesses per second) or Argon2 (1,000 per second), those numbers multiply by factors of 300,000 to 10 million respectively.
The security industry's shift from "use complex passwords" to "use long passwords" is not a preference change — it is the math resolving a debate that should not have lasted as long as it did.
What Each Scoring Criterion Actually Measures
Length (40 points maximum) is the dominant factor because each additional character multiplies the search space by the full alphabet size. The tool awards 20 points at 8 characters, an additional 10 at 12, and another 10 at 16. Going from 8 to 12 characters multiplies search space by roughly 10,000 times for a mixed character set. Going from 12 to 16 multiplies it by another 10,000 times. No other single criterion produces equivalent security gains per unit of effort.
Character set diversity (45 points maximum) breaks down as lowercase (+10), uppercase (+10), numbers (+10), and symbols (+15). Symbols receive the most points because they expand the per-position alphabet from 62 to 95 characters — the largest marginal expansion available. Each added character type forces an exhaustive attacker to search a wider space at every position simultaneously.
Pattern avoidance (15 points) operates differently from the other criteria — it does not increase theoretical entropy, it prevents you from wasting the entropy you have. No triple-repeated characters (+5) catches sequences like "aaa" or "111" where three positions carry the information of one. No common patterns (+10) catches leading sequences — "123...", "abc...", "qwerty...", "password..." — that appear in the first second of any dictionary attack because cracking tools try known patterns before exhaustive search. A password beginning with "password" has already failed before the attacker considers a single random character.
What the score cannot detect is important to understand. This checker has no access to breach databases, so it cannot flag passwords that have been leaked verbatim. It cannot identify dictionary words embedded in otherwise complex strings — "Sunshine#8!" scores well but "sunshine" appears in every wordlist. It cannot detect keyboard walks like "1qaz2wsx" that look random but are catalogued attack patterns. The checker measures theoretical strength. The generator eliminates the entire category of human-pattern weakness by removing human choice from the equation.
Why Generated Passwords Are Stronger Than Chosen Passwords (And How to Use Them)
When people construct passwords they believe are random, they follow predictable rules: capitalize the first letter, substitute a→4, e→3, o→0, place numbers and symbols at the end, and anchor the structure to something memorable — a name, a date, a pet. Attackers encode all of these substitution rules into their cracking tools and run them against every dictionary word before attempting exhaustive search. The password "P4ssw0rd!2024" satisfies most complexity checklists and would be tried within seconds by any rule-based attack.
This tool's generator uses crypto.getRandomValues() — the browser's cryptographic random number generator, which draws entropy from hardware-level sources: interrupt timing, CPU noise, and operating system entropy pools. Each character position is independently sampled across the full selected alphabet with no correlation to previous positions, no learned bias, and no human preference. A 16-character output using all character types has the full theoretical entropy of log₂(95¹⁶) ≈ 105 bits. No human-constructed password reliably achieves this, because constructing truly random sequences is not something human cognition does well.
The practical implication is that generated passwords are not designed to be memorized — they are designed to be stored. Copy the output with the one-click copy button and paste it into a password manager: Bitwarden, 1Password, or KeePass. The password manager handles recall and autofill. Your cognitive load reduces to one credential: the manager's master password, which you can make a long passphrase of four or five random words that you actually can memorize.
For passwords that must be typed manually — Wi-Fi networks, phone unlock codes, shared credentials — use the length slider to generate a longer password with fewer character types rather than a shorter password with all types. A 20-character lowercase password (26²⁰ ≈ 2×10²⁸ possibilities) is mathematically stronger than a 10-character fully complex password (95¹⁰ ≈ 6×10¹⁹) and far easier to type accurately. For Wi-Fi specifically, Tooliest's QR Code Generator can encode the full network credentials into a scannable code so guests connect without typing the password at all.
Frequently Asked Questions
How do I check my password strength online?
Type or paste any password into the checker field — the 0 to 100 strength score updates in real time as you type. The scorer evaluates length as the primary factor, then character diversity across uppercase, lowercase, numbers, and symbols, then pattern detection for repeated characters and common prefixes like '123' or 'password'. A visual bar and color coding show the result across five bands from Very Weak to Very Strong, with specific improvement tips below. Everything runs in JavaScript in your browser — your password is never transmitted anywhere. Verify by opening the Network tab in DevTools while typing.
How do I generate a strong password?
Click Generate & Check to create a cryptographically random password using your browser's crypto.getRandomValues() API, which draws from hardware entropy sources rather than a deterministic algorithm. The default output is 16 characters using all four character sets — uppercase, lowercase, numbers, and symbols — which scores Very Strong and carries approximately 105 bits of entropy. Use the length slider to go up to 64 characters, and toggle any character set that your target system does not accept. Copy with the one-click button and store the result in a password manager — generated passwords are not designed to be memorized.
How long should a password be?
Twelve characters is the practical minimum for general accounts. Sixteen or more for sensitive accounts including email, banking, and password managers. Length is the single most impactful security factor because each additional character multiplies the attacker's search space by the full alphabet size. A 12-character lowercase password (26¹² ≈ 95 quadrillion combinations) has a larger search space than an 8-character fully complex password (95⁸ ≈ 6.6 quadrillion). At 10 billion guesses per second against an unsalted MD5 hash, the 8-character complex password falls in 11 minutes; the 12-character lowercase password takes approximately 5 years.
Is it safe to check my password using an online tool?
With this tool, yes. The strength scoring runs entirely in JavaScript on your device. No network request is made when you type — your password never leaves your browser tab. You can confirm this by opening your browser's DevTools, going to the Network tab, and typing in the checker field: the network log stays empty. For checking whether your password has appeared in a known data breach, use Have I Been Pwned's k-anonymity API, which sends only the first five characters of your password's SHA-1 hash — never the full password or hash.
How do I generate a password with symbols and numbers?
All four character sets are enabled by default: uppercase letters (A-Z), lowercase letters (a-z), numbers (0-9), and symbols (!@#$%^&*()_+-=[]{}|;:,.<>?). Toggle any set off if the system you're creating the password for rejects certain character types — some legacy systems reject symbols or limit which ones are accepted. The length slider runs from 4 to 64 characters. The generator uses crypto.getRandomValues() for each character position independently, which produces true cryptographic randomness rather than the deterministic pseudorandomness of Math.random().
What actually makes a password strong?
Length is the primary factor — each additional character multiplies the search space by the alphabet size, which means length gains compound exponentially. After achieving sufficient length (12 or more characters), adding character types increases the per-position search space: including symbols expands the alphabet from 62 to 95 characters, the largest marginal gain available. Avoiding patterns matters separately from entropy — dictionary words, keyboard walks, and common substitutions are tried first in any real attack, so a technically long password built on a dictionary word fails faster than its raw length suggests. The strongest passwords are generated randomly, not chosen by a human, because human construction introduces systematic biases that cracking tools exploit.
Explore Related Categories
- Encoding Tools - 4 tools
- Developer Tools - 6 tools
- Image Tools - 7 tools