Parooli tugevuse kontrollija

How strong is your password, really?

This password strength checker rates a password the way a real attacker would — not by ticking off "has an uppercase letter" boxes, but by estimating how many guesses it would take to break. As you type, a live meter shows a rating from very weak to very strong, the password's entropy in bits, and an estimated time to crack, alongside specific feedback on what's weakening it.

Because it scores the way attackers actually work, it can see through tricks that fool simpler tools. "Summer2024!" looks complex but rates poorly; a four-word passphrase rates very strong. That's the difference a realistic, zxcvbn-style model makes.

How we measure strength: entropy plus pattern detection

Naive meters multiply character-set size by length and call it entropy. That over-rates predictable passwords. Instead, this checker uses a zxcvbn-style approach: it scans your password for dictionary words, common names, keyboard runs (qwerty, asdf), number and letter sequences (1234, abcd), repeats (aaaa), years and dates, and common-password matches — then estimates the smallest number of guesses that would find it.

The result is shown as password entropy in bits and a 0–4 strength score. Each extra bit of entropy doubles the work for an attacker, so the difference between 40 bits and 60 bits is not 50% more effort — it's roughly a million times more.

Time to crack: what the estimate means

The time to crack is the estimated number of guesses divided by how fast an attacker can guess. We show three scenarios: a throttled online attack (~1,000 guesses/sec, what a well-defended login form allows), a fast offline GPU (~10 billion/sec, a stolen password database being cracked), and a large cracking rig (~100 trillion/sec, the worst case).

These are estimates, not promises — real speed depends on the hashing algorithm and hardware. Use the numbers as a relative guide: if your password falls in seconds to a fast offline attack, it needs to be longer; if it survives for centuries, it's in good shape.

What makes a strong password

Length beats complexity. Because each character multiplies the search space, a long passphrase of ordinary words is stronger than a short string of symbols. Aim for 12–16 or more characters, avoid anything an attacker can predict — names, birthdays, years, sports teams, keyboard patterns and simple letter-to-symbol swaps — and never reuse a password between sites.

The strongest, easiest option is a password manager that generates a unique random password for every account. You remember one strong master passphrase; it remembers everything else, removing the reuse that causes most account takeovers.

Is it safe to test a password online?

Usually that's a real risk: many online checkers send your password to a server. This one does not. Every calculation runs locally in your browser with JavaScript — your password is never uploaded, logged or stored, and nothing persists after you close the tab. You can confirm it by watching your browser's network tab while you type: zero requests.

Even so, build the habit of never pasting a live password into a checker you don't trust. If you're unsure about a tool, test a password of the same length and style rather than your real one.

Tips to make your password stronger

Add length before anything else — a couple of extra random words does more than any symbol. Combine four or more unrelated words into a passphrase, or let a generator produce 16+ random characters. Drop predictable ingredients: your name, the current year, "qwerty", "123456", or "P@ssw0rd"-style substitutions that crackers expect.

Then read the feedback the tool gives you. It names the exact weakness it found — a common word, a sequence, a repeat, a date — so you know precisely what to change to move from weak to very strong.

How UtiloKit compares to Kaspersky, NordPass, and Dashlane password checkers

Dedicated password strength tools from Kaspersky (password.kaspersky.com), NordPass, and Dashlane all transmit your typed password to their servers to score it. That's a real privacy concern — you're handing your potential credential to a third party's infrastructure. Even if they claim not to store it, you're trusting their policy and their infrastructure to be secure.

UtiloKit's password strength checker runs entirely in your browser. Nothing leaves your device. The analysis is powered by the same zxcvbn-style pattern detection used in enterprise security tools, gives you entropy in bits (not just a vague 'strong' label), and shows crack-time estimates across three distinct attack models including offline GPU attacks. It also works fully offline once the page loads, and requires no account, no sign-up, and no app. If you want to know how strong your password actually is without sending it anywhere, this is the safer choice.

The mathematics of password entropy

Password entropy is calculated with a simple formula: bits = log₂(N^L), where N is the size of the character set you draw from and L is the password's length. An 8-character all-lowercase password draws from 26 characters, giving 26^8 ≈ 208 billion possibilities — which sounds enormous until you express it as log₂(26^8) = 37.6 bits of entropy. Expand to mixed case, digits, and common symbols (a set of 94 characters) and 8 characters yields log₂(94^8) = 52.4 bits — meaningful, but still reachable by a GPU rig in hours. Stretch that lowercase-only password to 20 characters and the entropy jumps to log₂(26^20) = 94 bits, far beyond what any plausible hardware can brute-force in a human lifetime.

This arithmetic explains why length beats complexity in almost every scenario. Adding four more characters to a lowercase-only password (going from 8 to 12 characters) adds roughly 18.8 bits of entropy. Adding every symbol type to an 8-character password adds only about 14.8 bits. The length gain is larger — and it is easier to type. The practical takeaway: if you can only make one change to a weak password, make it longer.

Where the formula breaks down is predictability. It assumes you choose each character at random from the full set. In practice, humans do not: they front-load capital letters, end with punctuation, substitute a→@ and e→3 in predictable ways, and build passwords around real words. That is why the zxcvbn library, originally released by Dropbox in 2012, remains the modern benchmark for realistic strength estimation. Instead of applying the raw formula, zxcvbn models what an attacker already knows — the 10,000 most common passwords, names, English words, and keyboard adjacency patterns — and estimates the minimum number of guesses an intelligent attack would need, which is nearly always far fewer than the theoretical formula implies.

How attackers actually crack passwords

A dictionary attack is the attacker's first move: try every word in a known wordlist before attempting random guesses. The most famous wordlist is RockYou, a file of 14.3 million real passwords leaked in a 2009 breach of the social-gaming platform RockYou Inc. Passwords like "iloveyou", "princess", and "abc123" come directly from that list and fall in milliseconds. Far larger is the Have I Been Pwned database compiled by security researcher Troy Hunt, which now contains over 847 million unique passwords harvested from hundreds of data breaches. Any password that appears in that corpus is considered compromised regardless of how complex it looks — someone has already used it, which means it is on every serious attacker's wordlist.

Modern crackers extend dictionaries with rule-based attacks. Tools like Hashcat apply transformation rules to every entry in a wordlist: capitalize the first letter, append years 2020–2024, substitute letters with common l33tsp34k equivalents (a→@, e→3, s→$, i→1), add trailing punctuation. A dictionary of 10 million words combined with 500 common rules generates billions of candidates and still runs in minutes on modern GPU hardware. This is exactly why "Password2024!" scores poorly: the underlying word and the appended year and symbol are all transformations Hashcat applies automatically to the word "password".

Rainbow tables are precomputed lookup tables that map known password hashes back to their plaintext. They make cracking nearly instant — until salts are applied. A salt is a random value added to each password before hashing, ensuring that even two users with the same password have different hashes, which makes precomputed tables useless. This is why modern systems use bcrypt, scrypt, or Argon2 rather than fast general-purpose hashes like MD5. A high-end GPU cluster can test 100 billion MD5 hashes per second, reducing an 8-character password to a solved problem in hours; bcrypt deliberately slows that rate to thousands per second, buying years of protection for the same password.

What NIST SP 800-63B changed about password rules

In 2017 the National Institute of Standards and Technology published Special Publication 800-63B, overhauling password guidance that had been largely unchanged since 2003. The core reversals were stark: NIST said to stop requiring periodic password rotation. Forced 90-day changes do not improve security — they train users to make minimal, predictable increments (Password1 → Password2 → Password3), which are trivially modelled by cracking rules. Change a password only when there is evidence of compromise.

NIST also said to stop imposing arbitrary complexity rules ("must contain uppercase, lowercase, digit, and symbol"). Studies consistently showed that complexity mandates push users toward predictable patterns: a capital letter at the start, a number and an exclamation mark at the end. The result is passwords that pass the rules but are deeply predictable. Instead, NIST now recommends checking passwords against lists of known compromised passwords and rejecting any that appear — a genuinely security-improving check, unlike complexity requirements.

The positive prescriptions matter equally. Verifiers should accept passwords up to at least 64 characters to accommodate passphrases and password-manager output. They must allow paste into password fields — blocking paste actively harms security by preventing password manager use, forcing users to either memorise weaker passwords or type long ones with errors. These guidelines now form the baseline expectation for any well-designed authentication system, and they shift the conversation from "is this password complex enough?" to the more useful question: "has this password been seen in a breach?"

Data breaches, credential stuffing, and why reuse is the real threat

The Have I Been Pwned (HIBP) service, launched by security researcher Troy Hunt in 2013, provides a public window into the scale of the problem. It catalogues hundreds of major data breaches — Yahoo 2013 (3 billion accounts), LinkedIn 2012 (117 million), Adobe 2013 (153 million) — allowing anyone to check whether their email address or password has been exposed. The password-checking API uses a k-anonymity model for privacy: your client computes the SHA-1 hash of the password, sends only the first five characters of that hash to the server, and receives back all matching hash suffixes. Your full password is never transmitted, yet you learn whether it appears in the breach corpus.

Credential stuffing is what happens once breached username-and-password pairs hit the internet. Attackers run automated tools that try each leaked credential against hundreds of other services — email providers, banks, streaming platforms. Because people reuse passwords across sites, a breach at a low-security forum can unlock accounts on high-value services that were never themselves compromised. Sentry's 2022 public incident report described attackers using credentials stolen from entirely unrelated services to access Sentry accounts — a textbook credential-stuffing attack. No amount of password strength on the targeted site matters if the credential was already public from a different breach.

This is why "use a unique password everywhere" is consistently ranked as the single highest-impact security practice — ahead of complexity rules, ahead of periodic rotation, and second only to enabling multi-factor authentication. A password manager makes uniqueness effortless: it generates a different random credential for every site, so a breach anywhere exposes credentials that are useless anywhere else. Checking a password's strength is the first step; ensuring it is unique and has not appeared in a known breach is the second.