Тестер силы пароля

Узнайте, сколько времени потребуется реальному атакующему, чтобы взломать ваш пароль — в четырёх реалистичных сценариях.

0 символов
— 0.0 бит · 0 попыток (среднее)

Сколько до взлома?

Онлайн · с лимитом
~100 попыток/час —
Онлайн · без лимита
~10 попыток/секунду —
Офлайн · медленный хэш
~10 000/секунду (bcrypt) —
Офлайн · быстрый хэш
~10 млрд/секунду (MD5 GPU) —

Обнаруженные шаблоны

  • Введите пароль выше, чтобы начать анализ.

Рекомендации

  • Рекомендации появятся, как только начнёте печатать.

Ваш пароль никогда не покидает устройство — весь анализ в браузере.

What is this password strength tester?

This free, browser-only tool measures the real strength of a password by combining character-pool entropy with pattern detection (common-password lists, sequences, repeats, dates, keyboard runs and dictionary words), then projects realistic crack-times against four attacker scenarios.

How strong is my password really?

Type or paste a password and the tester shows its effective entropy, four crack-time estimates and exactly which patterns weaken it — all locally in your browser.

Key features

Four-scenario crack-time
See how long an online throttled, online unthrottled, offline bcrypt and offline MD5-GPU attack would take.
Pattern detection
Catches common passwords, sequences (1234, abc), keyboard runs (qwerty), repeats, years and date-like numbers.
Actionable suggestions
Tells you exactly what to add or remove to reach the next strength tier.
Private by design
Nothing is uploaded; the password lives only in the DOM and disappears on Clear.

How to use it

Type a password into the field. The strength label, entropy in bits and the four crack-time scenarios update live. The detected-patterns panel highlights weaknesses; the suggestions panel tells you what to fix.

Frequently asked questions

Is the password I type sent to a server?

No. The entire analysis runs in your browser. Nothing is uploaded, logged or saved to disk — closing the tab forgets the value.

What do the four attack scenarios mean?

They model realistic attacker capabilities: an online attack against a rate-limited login (100/hour), an online attack against an unprotected endpoint (10/second), an offline crack against a slow hash like bcrypt (10K/second), and an offline crack against a fast hash like MD5 or SHA-1 on modern GPUs (10 billion/second).

Why does the tool flag my password as weak when it has symbols?

Strength is not just about character variety. If the password is short, follows a common pattern (Password1!), contains a dictionary word, dates or keyboard runs, those patterns drastically reduce real-world entropy — even with a symbol thrown in.

Does it check breach databases?

It checks a built-in list of 2,000 most-common passwords from public breach compilations. For a full Have-I-Been-Pwned check, use the official k-anonymity API separately.

Penalty heuristics and rate assumptions are calibrated against the open-source zxcvbn estimator and current GPU benchmarks. Strength tiers map to NIST SP 800-63B guidance on memorized-secret entropy.