Password Security Auditor
Audit a list of passwords for strength, entropy, common patterns, and get detailed security recommendations for each one.
이 도구에 대해
Evaluate the security of an entire list of passwords at once without sending them to any server — all processing is done locally in your browser. Paste passwords one per line into the input area and click Audit to receive a detailed security report for every password. Each entry receives a strength score from 0 to 100, a visual strength bar, and a letter grade (A–F). The entropy calculation shows bits of entropy based on character set size and password length, giving you a mathematical measure of guessing difficulty. Issue detection flags specific weaknesses: too short (under 8 or 12 characters), all lowercase, no numbers, no special characters, repeated character sequences, keyboard walk patterns (qwerty, asdf, 12345), and basic dictionary words (a built-in list of common English words). Every password is checked against a hard-coded list of the 100 most common passwords worldwide. The summary dashboard shows the overall security score across all passwords, the number of critical and warning-level issues, and highlights the worst offenders. Each password row shows personalized, actionable recommendations. Passwords are never logged or transmitted.
사용 방법
- 1 Paste your list of passwords into the input area, one password per line.
- 2 Click 'Audit Passwords' to run the analysis.
- 3 Review the summary dashboard showing the overall score and issue counts.
- 4 Scroll through the per-password results to see strength scores, entropy, detected issues, and recommendations.
- 5 Click 'Export Report' to download a CSV of the audit results for documentation.
- 6 Use the sort options to order results by strength score (worst first) to prioritize fixes.
Why audit passwords in bulk
Checking one password tells you about one account; auditing a whole list tells you where your real risk lives. This tool takes a set of passwords — one per line — and scores each from 0 to 100, assigns a letter grade from A to F, calculates its entropy in bits, and flags the specific weaknesses it finds. The summary dashboard then rolls everything up into an average score, a total count of critical issues, and a count of warnings, so you can immediately see whether the set as a whole is healthy or hiding a few dangerous entries. It is built for reviewing an exported vault, a team's shared credentials, or a policy you are trying to enforce.
How entropy is calculated here
Entropy is the mathematical measure of how hard a password is to guess, expressed in bits, where each extra bit doubles the number of possibilities. This tool computes it as floor(length × log₂(poolSize)). The pool size is the number of distinct characters the password could be drawn from, built up by category: lowercase adds 26, uppercase adds 26, digits add 10, and any non-alphanumeric character adds 32, for a maximum pool of 94. So a 10-character lowercase-only password has a pool of 26 and entropy of floor(10 × log₂(26)) = floor(47.0) = 47 bits. Add uppercase, digits, and a symbol and the pool jumps to 94, lifting a 10-character password to floor(10 × log₂(94)) = 65 bits. As a rough guide, under 50 bits is weak, 60+ is solid, and 80+ is very strong.
What the scanner detects
The score starts at 100 and the auditor subtracts points for each problem it finds:
| Issue | Severity | Penalty |
|---|---|---|
| One of the top-100 most common passwords | critical | score set to 0 |
| Shorter than 8 characters | critical | −40 |
| Digits only | critical | −30 |
| 8–11 characters (still short) | warning | −20 |
Repeated characters (e.g. aaa) | warning | −15 |
Keyboard walk (e.g. qwer, 1234) | warning | −15 |
| Missing uppercase / lowercase / digit / symbol | warning | −10 each |
| Contains a common English word | info | −5 |
The final grade follows the score: A is 80+, B is 60+, C is 40+, D is 20+, and F is below 20. Note one deliberate rule — any password matching the hard-coded list of the 100 most common passwords is forced to 0, meaning an automatic F no matter how long it is, because a known-leaked password offers no protection regardless of its character count.
A worked example
Audit the password Summer2024. It is 10 characters, has uppercase, lowercase, and digits but no symbol (−10), and contains no top-100 entry or keyboard run. Its pool is 62, so entropy is floor(10 × log₂(62)) = 59 bits — borderline. The score lands around 90 (A), yet the missing-symbol warning and its predictable "word + year" shape make it weaker in practice than the number suggests. Now audit qwerty123: it triggers the keyboard-walk flag (−15), the no-uppercase and no-symbol warnings, and, being on the common list, is forced to score 0 and grade F. Seeing both side by side is exactly what the bulk view is for.
Practical tips
- Sort worst-first and fix the F and D entries before touching anything else — one reused weak password is a bigger risk than several merely-average ones.
- Treat warnings as cumulative. A password with three or four warnings is fragile even if no single flag is critical.
- Length beats complexity. Because entropy scales with length linearly, adding characters raises the bar faster than sprinkling in one symbol.
- Replace, do not patch. If a flagged password is one you reuse, generate a fresh random one per site rather than tweaking a digit.
Understanding the limits
This is a pattern-and-entropy auditor, not a breach lookup. It checks against a built-in list of the 100 most common passwords and a small dictionary of frequent words — it does not query "have I been pwned" style databases of billions of leaked credentials, so a password that is unique-looking here could still appear in a real-world breach. Use the result as a strength baseline, and pair any "strong" rating with a password manager and two-factor authentication.
Privacy
Every step runs locally in your browser using JavaScript. The passwords you paste are never transmitted over the network, logged, or stored anywhere outside the page — you can disconnect from the internet and the audit still works. That local-only design is what makes it safe to paste sensitive credentials in the first place.