Question 1

How is password entropy calculated?

Accepted Answer

The theoretical estimate is length multiplied by log base 2 of the detected character-pool size. The tool also applies a conservative penalty for repeated characters, sequences and common password patterns.

Question 2

How many bits of password entropy are strong?

Accepted Answer

Around 60 bits can resist many online attacks, while 80 bits or more offers a stronger margin for randomly generated passwords. Valuable offline hashes may need far more, depending on the hash algorithm and attacker.

Question 3

Are crack-time estimates exact?

Accepted Answer

No. They are illustrative brute-force estimates. Real results depend on hashing cost, hardware, rate limits, leaks, dictionaries, password reuse and attacker strategy.

Question 4

Is my password sent to a server?

Accepted Answer

No. The password is analyzed only in JavaScript within this page. Nothing is transmitted or stored by the tool.