Most password strength meters are superficial — they check for an uppercase letter, a number, and a symbol, and declare the password 'strong'. A password like 'Password1!' satisfies all these requirements while being one of the first passwords any attacker would try. Real password strength is measured in bits of entropy: a mathematical representation of how much randomness the password contains and how many guesses an attacker would need to crack it. The Utility Spark Password Strength Checker analyses your password using an entropy calculation that accounts for the actual character set used, detects common patterns that reduce effective entropy (keyboard walks like 'qwerty', dictionary words, dates, repetition), and estimates crack time against three attack scenarios: online attacks (throttled to ~100 attempts/second), offline attacks on a fast hash (billions/second on consumer hardware), and offline attacks against a slow hash like bcrypt. The analysis runs entirely in your browser — your password never leaves your device, which matters because typing your real password into an online form is a security risk in itself.
lightbulb When to use this tool
- check_circle Testing whether a password you created yourself is genuinely strong before using it for a high-value account.
- check_circle Checking whether a password generated by a tool (including our Password Generator) scores well on entropy analysis.
- check_circle Understanding why a seemingly complex password (like 'Password1!') is still weak against modern attacks.
- check_circle Evaluating a proposed password policy's strength requirements before implementing them in an application.
- check_circle Educational use: demonstrating to team members or end users what makes passwords genuinely strong or weak.
Why use our tool?
Entropy-Based Analysis — Not Just Character Type Rules
The tool calculates entropy in bits based on the actual character set used (26 lowercase, 26 uppercase, 10 digits, ~32 symbols) and the password length. A truly random password using all character sets at 16 characters has approximately 105 bits of entropy. Entropy-based analysis is far more meaningful than rule-based checks that can be fooled by passwords like 'Tr0ub4dor&3'.
Pattern Detection — Common Weaknesses Flagged
The analyser detects entropy-reducing patterns: keyboard walks (qwerty, asdf, 12345), dictionary words as a component, repeated characters or sequences (aaaa, abcabc), common substitutions (@ for a, 3 for e, 0 for o that attackers know to try), date patterns (DDMMYYYY), and common password base words. Each detected pattern is flagged with an explanation of why it reduces effective entropy.
Crack Time Estimates Across Three Attack Models
Three scenarios are estimated: (1) Online attack: ~100 attempts/second (throttled by rate limiting, 2FA, lockouts). (2) Offline attack on fast hash (MD5/SHA-256): billions of attempts/second on commodity GPU hardware. (3) Offline attack on slow hash (bcrypt/Argon2 cost 12): thousands of attempts/second — the correct model for properly hashed passwords. These estimates help you understand what 'safe' means in context.
Your Password Is Never Transmitted
Typing your password into an online form is a security risk. This tool evaluates your password entirely in your browser's local JavaScript context. No keystroke, no password fragment, and no entropy score is transmitted to any server. The tool is safe to use with your real passwords — but if in doubt, use a generated test password with similar properties.
Actionable Suggestions
Beyond the score, the tool provides specific suggestions for improving the password: increase length, add a character set that is missing, remove detected patterns. These suggestions give you a clear path from a weak or moderate password to a genuinely strong one.
How it works
Type your password into the input field. The analysis updates in real time as you type.
Review the entropy score (in bits) and strength label: Very Weak, Weak, Moderate, Strong, Very Strong.
Check the crack time estimates for online and offline attack scenarios.
Review any pattern warnings flagged by the analyser.
If improvements are needed, follow the suggestions and watch the score update as you modify the password.
Examples
science 'Password1!' — Why It Fails
Password: Password1!
Entropy: ~18 bits effective (dictionary word base, common substitutions, predictable structure)
Online crack time: Minutes to hours
Offline crack time (fast hash): Under 1 second
Issues detected: Dictionary word 'Password', leet substitution '1' for 'l', appended symbol '!' (known pattern)
science Random 20-Character Password
Password: zR#9mQ@vL2kX!nBw5sJ^
Entropy: ~131 bits
Online crack time: Centuries
Offline crack time (fast hash): Billions of years
Issues detected: None
Verdict: Very Strong — secure for all practical purposes