Test any password against live entropy math, crack-time estimates, and breach-pattern checks. Type below to get a 0-100 score with fix tips - all scoring stays in your browser.
Technical Specifications
Open scoring rules used for every password. No hidden weights.
| Specification |
Details |
| Score scale |
0 to 100: length up to 50 points (2.5 per character, capped at 20), variety up to 40 points (10 per set: upper, lower, digit, symbol) |
| Deductions |
Common password: capped at 5; single character set: -10; repeated run (aaa): -10; sequence (abc, 123): -10; under 8 chars: -5 |
| Rating bands |
0-29 Weak, 30-49 Fair, 50-69 Good, 70-84 Strong, 85-100 Very strong |
| Entropy formula |
bits = length x log2(pool size); pool is 26/26/10/27 per character set present |
| Crack-time model |
Average guesses = 2^(bits-1); online throttled 10/s, online fast 1,000/s, offline hash attack 10 billion/s |
| Common list |
Built-in list of the most breached passwords (123456, password, qwerty, letmein, and variants) matched case-insensitively |
| Processing location |
100% client-side JavaScript in your browser memory; nothing is uploaded |
| Export |
Copy the password to clipboard or download a plain-text report with score, entropy, and crack times |
| Usage limit |
None - test unlimited passwords for free, no signup required |
Understanding Password Attacks
Attackers rarely guess blindly. They start with billions of previously breached passwords, then try dictionary words with number swaps, then keyboard patterns, and only then brute force. A strength score must therefore punish predictability, not just reward length - which is exactly what the deduction rules above do.
Dictionary and credential-stuffing attacks
The cheapest attack is trying passwords leaked from other sites, since most people reuse them. Lists with hundreds of millions of entries test thousands of accounts per second. Any password on those lists - even a long one like Spring2024! - falls almost instantly, which is why a common-password match caps this score at 5 regardless of length.
Brute force and why entropy matters
Against a truly random password, the attacker must on average try half of all combinations: 2^(bits-1) guesses. Each added bit of entropy doubles the work. A 56-bit password falls to an offline rig in hours, while a 104-bit password needs billions of years. The offline crack-time row converts your entropy into that calendar figure at 10 billion guesses per second.
Online guessing is slower but still counts
Login forms with delays and lockouts allow roughly 10 guesses per second, so even a fair password survives years online. But databases get stolen, removing those limits - always judge a password by its offline time. For accounts that matter, aim for Strong (70+) and prefer Very strong (85+). Need a fresh one? Build it with the Password Generator and verify it here.
Honest limitations
This checker cannot query live breach databases, since that would require sending your password to a server - a trade the design refuses. Its built-in common list covers the worst offenders but not every leak. It also cannot see the site's lockout policy or whether you reuse the password elsewhere, so treat a high score as necessary but not sufficient: unique passwords plus a manager plus two-factor auth is the full answer.
Privacy and Client-Side Security
Privacy Guarantee: All scoring occurs locally inside your browser. Your passwords and keystrokes are never transmitted, stored, or recorded on remote servers.
Pasting a real password into a website is only safe when the page provably keeps it local. TinyToolzz scores with plain JavaScript in your tab: no network calls, no analytics payloads carrying input, no copies retained.
Because nothing is uploaded, there is no waiting, no account, and no trace of your passwords anywhere. Your values exist only in the tab's memory and are discarded when you close the page or click Clear.