Password Strength Meter
Estimate crack-time and audit password composition in real time.
What this plugin does
The Password Strength Meter evaluates length, character diversity, common-word patterns and entropy to estimate how long a modern GPU cluster would need to crack the password offline. Everything runs locally in your browser — the password never leaves the page.
Character-set size × length gives raw entropy in bits; we discount predictable substitutions (P@ssw0rd) and dictionary tokens.
Length ≥ 12, uppercase, digit and symbol classes are required to reach 'Strong'.
We assume an offline attacker at 10¹¹ hashes/second (bcrypt cost 5) and convert entropy to a wall-clock estimate.
Signals we analyse
- Length in characters
- Uppercase / lowercase / digit / symbol classes
- Common-word and leetspeak substitutions
- Shannon entropy in bits
Common use cases
- Embed in signup forms to nudge stronger passwords
- Audit passwords during onboarding without exfiltrating them
- Train employees on what a strong passphrase actually looks like
What a full scan returns
This is what the paid, deep-scan version of the plugin produces — a full breakdown you can export as PDF or JSON.
- passLength16 characters
- passCharacter classes4 / 4
- passEntropy94 bits
- passDictionary hitno matches
- passEstimated crack time3.4 centuries
Frequently asked questions
Is my password sent anywhere?
No. Scoring runs entirely in the browser — nothing is transmitted or logged.
Why is 'Guardian2026!' only Fair?
It uses a common word plus year — dictionary + pattern penalties cap the entropy.
What's the recommended minimum?
12+ characters with all four classes, or a 20+ character passphrase of unrelated words.
Other free plugins
Ready for the full Password Strength Meter?
Preview mode uses simulated data. Unlock live results, historical trends, exports and API access.