Password Strength Checker
Entropy in bits, the character pool it assumes, and how long an offline attacker would need at a given guess rate.
Worked example
A 20-character passphrase of random lowercase words carries roughly 100 bits; an 8-character password mixing cases, digits and symbols carries about 52. Doubling length multiplies the search space; adding one symbol class adds a single factor of about 1.3.
Entropy here is measured as length × log2(pool), adjusted downward for repeated characters. That is the standard back-of-envelope model: it assumes an attacker who knows your character classes and searches the whole space uniformly. A real attacker does better — dictionaries, mangling rules, and every password from every breach — which is why a password that scores well here can still fall in minutes if it is a known phrase with substitutions.
Reading the numbers
Forty bits is the line where a determined hobbyist with a GPU stops caring. Sixty bits is where a funded attacker starts to hesitate. Eighty and above is out of reach for offline attacks against a properly salted, slow hash. The crack-time figure assumes a fast hash; against bcrypt at a sensible cost factor, divide the effective rate by several orders of magnitude.
Why length wins
Each additional character multiplies the search space by the pool size. Each additional character *class* multiplies it by a much smaller factor, and in practice reduces memorability, which pushes people toward reuse and written notes. A four-word passphrase beats a nine-character scramble on both entropy and recall.
What this checker cannot tell you
It does not know whether your password appeared in a breach dump. A 30-character string published in a leak is worth zero bits regardless of what the arithmetic says. Check breach exposure separately, and use a password manager so that no two accounts share a secret.