Password Strength Checker

The analysis runs entirely in your browser with zero network activity — verifiable in DevTools. That said, the healthiest habit is testing a candidate pattern rather than a live credential: check 'the kind of password you use,' learn what weakens it, then generate a fresh one.

The offline figure assumes an attacker has stolen a database of fast hashes and runs GPUs at ~10 billion guesses/second — the disaster scenario. The online figure assumes guessing through a rate-limited login form. Real strength lives between them, which is why 'centuries offline' is the target worth hitting.

Because crackers don't brute-force character by character; they try patterns. Word + year + trailing symbol is among the first templates every cracking tool generates. Character-class checklists measure compliance, not strength — length and unpredictability are what actually cost an attacker time.

Length plus randomness: a 16+ character generated password, or four-plus truly random words (the passphrase approach — long, strong, and typeable). Unique per site, stored in a password manager, with the memorization budget spent on the manager's master passphrase alone.