密码生成器
检查您的密码强度——熵值评分、破解时间估算和可操作的改进建议。
关于此工具
使用真实的熵计算（位数）、现代硬件上的预计破解时间和具体的改进建议来分析任意密码的强度。显示字符集覆盖率、常见模式检测和NIST 800-63B合规性。
使用方法
- 1 在输入框中输入您的密码。
- 2 即时查看强度计、熵值和预计破解时间更新。
- 3 阅读具体的改进建议。
- 4 使用密码生成器工具创建强密码。
What "strength" actually measures
A password's strength is not how complicated it looks to you — it's how many guesses an attacker would need to find it. This checker reduces that idea to a single number, entropy, measured in bits. Each extra bit of entropy doubles the number of possibilities a cracking program must work through, so going from 40 to 41 bits doesn't add a little safety — it doubles it. Everything the meter shows, from the colored bar to the crack-time estimate, is derived from this one calculation, performed entirely in your browser as you type.
The exact entropy formula used here
This tool computes entropy as length × log2(charset_size), where the character-set size is the sum of every category your password actually contains:
| If the password contains… | Pool added |
|---|---|
| Lowercase letters (a–z) | 26 |
| Uppercase letters (A–Z) | 26 |
| Digits (0–9) | 10 |
| Any symbol or non-alphanumeric character | 32 |
Notice the consequence: a 12-character all-lowercase password draws from a pool of 26, but adding a single uppercase letter expands the pool to 52 for the whole string, raising every character's contribution. The size of the pool, not where the special character sits, is what moves the number.
A worked example
Take Tr0ub4dor (9 characters, mixed case plus digits). The pool is 26 + 26 + 10 = 62, so log2(62) ≈ 5.95 bits per character, giving roughly 9 × 5.95 ≈ 54 bits. The crack-time estimate assumes a GPU rig trying 10 billion guesses per second (10^10/s) — realistic for an attacker working offline against a leaked hash. At 54 bits there are about 1.8 × 10^16 possibilities, which is around three weeks of guessing. Now stretch the same style to 16 characters: 16 × 5.95 ≈ 95 bits, and the estimate jumps past "centuries." The only thing that changed was length.
Length beats complexity — the math proves it
Because entropy is length multiplied by a per-character constant, adding characters scales the whole sum linearly, while adding a new character type only nudges the constant. Four extra characters typically buys you more bits than sprinkling in one symbol. That is why a long passphrase like amber-canyon-rotor-thistle can outscore a short jumble such as X9$kq while being far easier to type. If a site caps length, max out variety to compensate; if it doesn't, prefer length.
What the ten checks are really doing
Alongside entropy, the analysis runs ten pass/fail checks and counts how many pass — that count drives the Weak/Fair/Good/Strong/Very Strong rating. They include length thresholds (8 and 16), presence of each character type, and three pattern traps: a run of three identical characters (aaa), an all-letters or all-digits password, and a match against a built-in list of the most leaked passwords (password, qwerty, 123456 and similar). A password can have high raw entropy yet still fail these, which is the point — a 9-character random string scores differently from aaaaaaaaa even when a naive formula treats them alike.
Common mistakes the meter exposes
- Padding with repeats.
Password11111111looks long, but the repeated tail adds almost no real unpredictability and trips the "no repeated characters" check. - Leetspeak on a dictionary word.
P@ssw0rdis one of the first things a cracker tries; predictable substitutions don't add the entropy the raw character count suggests. - Year and season patterns.
Summer2026!passes the character-type checks but follows a template attackers generate automatically. - Trusting a single strong password everywhere. Entropy protects against brute force, not against reuse; one breach exposes every site that shares the password.
How to act on the result
NIST's SP 800-63B guidance favors length (15+ characters), screening against known-breached passwords, and dropping forced periodic rotation — all of which align with what this meter rewards. Aim for at least 70 bits on everyday accounts and 100+ on anything you truly care about, store the result in a password manager rather than memorizing it, and turn on two-factor authentication so even a leaked password isn't enough on its own.
Is your password sent anywhere?
No. This is a decode-and-analyze tool with no randomness and no network calls — the entropy math, the checks, and the crack-time estimate all run in JavaScript on your device. You can disconnect from the internet and the meter still updates as you type, because there is nothing to transmit. Nothing you enter is logged or stored.