User Rating 0.0
Total Usage 2 times
Category Security
Waiting for input... 0 bits
Time to Crack (RTX 4090)
Instant
At 100 GH/s
Char Pool Size
0
Combinations
Estimated Cost
$0
Energy & Hardware
Is this tool helpful?

Your feedback helps us improve.

About

This is not just a checker; it is a forensic instrument for your credentials. In an era where billions of passwords are leaked annually, knowing if yours is on a list is the baseline. Understanding why it is secure (or vulnerable) is the next level of defense. This tool employs Zero-Knowledge k-Anonymity to cross-reference your password against over 800 million exposed records without ever sending your actual password over the internet.

Simultaneously, the local engine performs a cryptographic autopsy on your input. It calculates Shannon Entropy (measured in bits), detects human behavioral patterns (like keyboard walks or dates), and simulates an attack by a modern GPU cluster. The result is a precise estimation of the financial and temporal cost required to crack your key.

password audit hibp check entropy calculator brute force time cybersecurity tool

Formulas

The core metric of password strength is Information Entropy (E), which defines the size of the keyspace the attacker must search.

E = L × log2R

Where L is the length and R is the pool of unique characters used. The time to crack (T) is calculated probabilistically (average 50% search space):

T = 2E-1HashRate

Reference Data

Attacker ProfileHash Rate (guesses/sec)Threat Context
Script Kiddie (Laptop)10 MH/sGeneric malware, opportunistic attacks.
Professional Hacker (RTX 4090)100 GH/sTargeted attacks on individuals.
Mining Farm (100x GPUs)10 TH/sIndustrial espionage, ransomware gangs.
State Actor (Supercomputer)100 PH/sNational security threats, high-value targets.

Note: Rates are based on SHA-1/MD5 benchmarks. Slow hashing functions (Bcrypt/Argon2) significantly reduce these rates.

Frequently Asked Questions

Yes. We use the Web Crypto API standard. Your password is hashed (converted to a math string) inside your browser. Only the first 5 characters of that hash are sent to the checking server. This technique, called k-Anonymity, ensures it is mathematically impossible for the server to reverse-engineer your password.
For banking and email, aim for roughly 70+ bits. This usually requires a password of 12+ characters with mixed types. For a crypto wallet or master password, aim for 100+ bits (roughly 16-20 random characters).
Our algorithm detects common human behaviors that reduce security. Sequences like "123", keyboard walks like "qwerty", or repeated characters "aaa" make a password predictable, significantly lowering the effective entropy even if the password is long.
Change it immediately. Being in a breach database means hackers have a copy of it. If you use that password on other sites (credential stuffing), those accounts are also at risk. Use our built-in generator to create a new one.