Password strength analyser

THE PRACTICAL GUIDE · NORMANDIN SYSTEMS

Get more from Password strength analyser

Password Strength Analyser estimates a brute-force search space from the length and character classes of a password you enter. The workspace accepts one password and automatically displays an estimated cracking duration, password length, entropy, character-set size, and score. It does not generate passwords, offer a quantity selector, or recognize dictionary words and familiar phrases. This particular model assumes a character alphabet inferred from the sample and a fixed guessing rate; it does not measure the real resistance of an account or a stored password hash. Use disposable examples to understand how its arithmetic changes with length and character classes, and keep the displayed duration separate from an actual security assessment.

Guide updated October 13, 2026

How to use this tool

1. Enter a disposable sample in the password field. The estimate and detail fields update automatically; there is no generation step.
2. Read Password length, Entropy, Character set size, and Score together with the displayed brute-force duration.
3. Change one property at a time, such as adding a character or introducing an uppercase letter, and compare how the model responds.
4. Read the dictionary-attack limitation below the results. Do not use a high score or long displayed duration as proof that a memorable or reused password is safe.

SEE IT IN PRACTICE

A worked example

abcd

Length: 4; character-set size: 26; entropy: approximately 18.80; score: 15 / 100; duration: instantly

The model counts a lowercase alphabet of 26 and calculates log2(26) × 4. Its duration is 26^4 divided by one billion guesses per second. The same-length lowercase sample aaaa receives the same arithmetic estimate, exposing the model's lack of pattern analysis.

Understand the alphabet and score calculation

The implementation adds 26 to the inferred alphabet when lowercase Latin letters are present, 26 for uppercase letters, 10 for digits, and 32 when its special-character test matches. It multiplies the password length by the base-two logarithm of that alphabet size. The score is that estimate divided by 128, capped at one, and displayed on a 100-point scale. This is a mathematical model of a search space, not measured information about how the particular string was selected.

The length comes from JavaScript's string length, so some Unicode characters can occupy more than one counted code unit. The fixed character-class assumptions also do not model every writing system or password-generation process. These details make the displayed entropy an approximation under specific assumptions rather than a universal property of the text.

Use the estimate to learn, not to certify

A useful exercise compares two same-length lowercase samples, one repeated and one less structured. Their identical result shows what the model omits. Then add length or a new character class to see the arithmetic change. A person choosing a predictable phrase is not selecting uniformly from every string in the inferred alphabet, so the brute-force space can overstate practical resistance. Keep that distinction visible whenever the tool is used in training or documentation.

When this tool is useful

• Illustrate the arithmetic effect of password length
• Compare inferred character alphabets with disposable examples
• Teach the limitations of a simple brute-force estimate

Tips for a better result

• Use synthetic examples rather than a real account password when demonstrating or comparing estimates.
• A repeated or familiar string can receive the same result as a less predictable string with the same length and detected character classes.
• Consider password uniqueness, exposure, phishing, account protections, and the actual storage scheme separately from this display.

Frequently asked questions