Password Security Auditor

Why audit passwords in bulk

Checking one password tells you about one account; auditing a whole list tells you where your real risk lives. This tool takes a set of passwords — one per line — and scores each from 0 to 100, assigns a letter grade from A to F, calculates its entropy in bits, and flags the specific weaknesses it finds. The summary dashboard then rolls everything up into an average score, a total count of critical issues, and a count of warnings, so you can immediately see whether the set as a whole is healthy or hiding a few dangerous entries. It is built for reviewing an exported vault, a team's shared credentials, or a policy you are trying to enforce.

How entropy is calculated here

Entropy is the mathematical measure of how hard a password is to guess, expressed in bits, where each extra bit doubles the number of possibilities. This tool computes it as floor(length × log₂(poolSize)). The pool size is the number of distinct characters the password could be drawn from, built up by category: lowercase adds 26, uppercase adds 26, digits add 10, and any non-alphanumeric character adds 32, for a maximum pool of 94. So a 10-character lowercase-only password has a pool of 26 and entropy of floor(10 × log₂(26)) = floor(47.0) = 47 bits. Add uppercase, digits, and a symbol and the pool jumps to 94, lifting a 10-character password to floor(10 × log₂(94)) = 65 bits. As a rough guide, under 50 bits is weak, 60+ is solid, and 80+ is very strong.

What the scanner detects

The score starts at 100 and the auditor subtracts points for each problem it finds:

The final grade follows the score: A is 80+, B is 60+, C is 40+, D is 20+, and F is below 20. Note one deliberate rule — any password matching the hard-coded list of the 100 most common passwords is forced to 0, meaning an automatic F no matter how long it is, because a known-leaked password offers no protection regardless of its character count.

A worked example

Audit the password Summer2024. It is 10 characters, has uppercase, lowercase, and digits but no symbol (−10), and contains no top-100 entry or keyboard run. Its pool is 62, so entropy is floor(10 × log₂(62)) = 59 bits — borderline. The score lands around 90 (A), yet the missing-symbol warning and its predictable "word + year" shape make it weaker in practice than the number suggests. Now audit qwerty123: it triggers the keyboard-walk flag (−15), the no-uppercase and no-symbol warnings, and, being on the common list, is forced to score 0 and grade F. Seeing both side by side is exactly what the bulk view is for.

Practical tips

• Sort worst-first and fix the F and D entries before touching anything else — one reused weak password is a bigger risk than several merely-average ones.
• Treat warnings as cumulative. A password with three or four warnings is fragile even if no single flag is critical.
• Length beats complexity. Because entropy scales with length linearly, adding characters raises the bar faster than sprinkling in one symbol.
• Replace, do not patch. If a flagged password is one you reuse, generate a fresh random one per site rather than tweaking a digit.

Understanding the limits

This is a pattern-and-entropy auditor, not a breach lookup. It checks against a built-in list of the 100 most common passwords and a small dictionary of frequent words — it does not query "have I been pwned" style databases of billions of leaked credentials, so a password that is unique-looking here could still appear in a real-world breach. Use the result as a strength baseline, and pair any "strong" rating with a password manager and two-factor authentication.

Privacy

Every step runs locally in your browser using JavaScript. The passwords you paste are never transmitted over the network, logged, or stored anywhere outside the page — you can disconnect from the internet and the audit still works. That local-only design is what makes it safe to paste sensitive credentials in the first place.