Type a password to see its estimated entropy, how long it would take to crack, and which weak patterns it contains.
The score starts from entropy: the size of the character pool actually used (lowercase, uppercase, digits, symbols) raised to the length, which estimates how many guesses a brute-force attack must make. It then subtracts for the patterns real cracking tools exploit first, dictionary words and common passwords, repeated characters, keyboard walks (qwerty, 1234), sequences, and dates. The crack-time figures assume an offline attack at roughly ten billion guesses per second against a fast hash, the pessimistic case that decides whether a leaked password survives.
Length beats complexity games: a five-word passphrase of ordinary words usually exceeds 60 bits of entropy and is easier to remember than a short symbol salad. Whatever the score, the two rules that matter most are uniqueness, never reuse a password across sites, and a password manager to hold them. The password typed here is analysed on this device only; it is never transmitted, logged or stored.
Is it safe to type a real password here? The check runs entirely in your browser with no network calls, and the page has no server. Even so, a sensible habit is to test a close variant of a real password rather than the password itself.
Why did a long password score lower than expected? Probably a pattern penalty: long but predictable (a quote, a song title, words plus a year) is cracked by dictionary attacks far faster than its length suggests.
What score should I aim for? 60+ bits for everyday accounts and 80+ for email and banking, the email account is the master key, because password resets flow through it.