← back to projects

Password Strength Analyzer

Real-time entropy analysis, crack-time estimates, and breach checking via HaveIBeenPwned with k-anonymity — everything below runs client-side in your browser.

view source on GitHub ↗
password-analyzer.sh
strength:EMPTY(0.0 bits)
# entropy
pool R  = —
        = 0
length L = 0
H = L * log2(R)
  = 0 * log2(0)
  = 0.00 bits
# estimated crack time (average case)
online
Online, rate-limited
~100 guesses / hour
instantly
Online, no rate limit
~10 guesses / second
instantly
offline
Offline, salted+slow hash
~10⁴ guesses / second (bcrypt/scrypt/argon2)
instantly
Offline, fast hash / GPU farm
~10¹⁰ guesses / second
instantly
# feedback
  • [ ] At least 12 characters
  • [ ] At least 8 characters (minimum)
  • [ ] Contains lowercase letters
  • [ ] Contains uppercase letters
  • [ ] Contains digits
  • [ ] Contains symbols
# breach check (haveibeenpwned)
waiting for input...
# privacy

Your password is never transmitted or stored anywhere. Everything above — entropy, crack-time estimates, and variety feedback — is computed locally in your browser.

The breach check uses k-anonymity: your password is hashed with SHA-1 locally (via the browser's WebCrypto API), and only the first 5 characters of that hash are sent to the HaveIBeenPwned API. The service returns every breached hash suffix sharing that 5-character prefix (typically hundreds of them), and the match against your full hash is done locally in this browser. The full password and full hash never leave your device.