비밀번호 생성기
비밀번호 강도를 확인하세요 — 엔트로피 점수, 해독 시간 예측, 개선을 위한 실용적인 팁.
이 도구에 대해
실제 엔트로피 계산(비트), 최신 하드웨어에서의 예상 해독 시간, 개선을 위한 구체적인 팁으로 비밀번호 강도를 분석하세요. 문자 세트 범위, 일반적인 패턴 감지, NIST 800-63B 준수 여부를 표시합니다.
사용 방법
- 1 입력 필드에 비밀번호를 입력하세요.
- 2 강도 미터, 엔트로피 점수, 예상 해독 시간이 즉시 업데이트되는 것을 확인하세요.
- 3 구체적인 개선 제안을 읽으세요.
- 4 비밀번호 생성기 도구를 사용하여 강력한 비밀번호를 만드세요.
What "strength" actually measures
A password's strength is not how complicated it looks to you — it's how many guesses an attacker would need to find it. This checker reduces that idea to a single number, entropy, measured in bits. Each extra bit of entropy doubles the number of possibilities a cracking program must work through, so going from 40 to 41 bits doesn't add a little safety — it doubles it. Everything the meter shows, from the colored bar to the crack-time estimate, is derived from this one calculation, performed entirely in your browser as you type.
The exact entropy formula used here
This tool computes entropy as length × log2(charset_size), where the character-set size is the sum of every category your password actually contains:
| If the password contains… | Pool added |
|---|---|
| Lowercase letters (a–z) | 26 |
| Uppercase letters (A–Z) | 26 |
| Digits (0–9) | 10 |
| Any symbol or non-alphanumeric character | 32 |
Notice the consequence: a 12-character all-lowercase password draws from a pool of 26, but adding a single uppercase letter expands the pool to 52 for the whole string, raising every character's contribution. The size of the pool, not where the special character sits, is what moves the number.
A worked example
Take Tr0ub4dor (9 characters, mixed case plus digits). The pool is 26 + 26 + 10 = 62, so log2(62) ≈ 5.95 bits per character, giving roughly 9 × 5.95 ≈ 54 bits. The crack-time estimate assumes a GPU rig trying 10 billion guesses per second (10^10/s) — realistic for an attacker working offline against a leaked hash. At 54 bits there are about 1.8 × 10^16 possibilities, which is around three weeks of guessing. Now stretch the same style to 16 characters: 16 × 5.95 ≈ 95 bits, and the estimate jumps past "centuries." The only thing that changed was length.
Length beats complexity — the math proves it
Because entropy is length multiplied by a per-character constant, adding characters scales the whole sum linearly, while adding a new character type only nudges the constant. Four extra characters typically buys you more bits than sprinkling in one symbol. That is why a long passphrase like amber-canyon-rotor-thistle can outscore a short jumble such as X9$kq while being far easier to type. If a site caps length, max out variety to compensate; if it doesn't, prefer length.
What the ten checks are really doing
Alongside entropy, the analysis runs ten pass/fail checks and counts how many pass — that count drives the Weak/Fair/Good/Strong/Very Strong rating. They include length thresholds (8 and 16), presence of each character type, and three pattern traps: a run of three identical characters (aaa), an all-letters or all-digits password, and a match against a built-in list of the most leaked passwords (password, qwerty, 123456 and similar). A password can have high raw entropy yet still fail these, which is the point — a 9-character random string scores differently from aaaaaaaaa even when a naive formula treats them alike.
Common mistakes the meter exposes
- Padding with repeats.
Password11111111looks long, but the repeated tail adds almost no real unpredictability and trips the "no repeated characters" check. - Leetspeak on a dictionary word.
P@ssw0rdis one of the first things a cracker tries; predictable substitutions don't add the entropy the raw character count suggests. - Year and season patterns.
Summer2026!passes the character-type checks but follows a template attackers generate automatically. - Trusting a single strong password everywhere. Entropy protects against brute force, not against reuse; one breach exposes every site that shares the password.
How to act on the result
NIST's SP 800-63B guidance favors length (15+ characters), screening against known-breached passwords, and dropping forced periodic rotation — all of which align with what this meter rewards. Aim for at least 70 bits on everyday accounts and 100+ on anything you truly care about, store the result in a password manager rather than memorizing it, and turn on two-factor authentication so even a leaked password isn't enough on its own.
Is your password sent anywhere?
No. This is a decode-and-analyze tool with no randomness and no network calls — the entropy math, the checks, and the crack-time estimate all run in JavaScript on your device. You can disconnect from the internet and the meter still updates as you type, because there is nothing to transmit. Nothing you enter is logged or stored.