Calculateus

Password Strength Checker

Estimate how long a password would take to crack based on its length and character variety.

Result

Strength
Strong
Character Pool Size
62
Estimated Time to Crack
5,111.71 years

Assumes a brute-force attack at 10 billion guesses per second (a realistic figure for offline attacks against a leaked, weakly-hashed password database) checking half the total combination space on average. This estimates theoretical brute-force resistance only - it can't detect whether a password is a common dictionary word or reused elsewhere, both of which make real-world cracking far faster.

About the Password Strength

The Password Strength Checker estimates how long a brute-force attacker would need to guess a password, based purely on its length and which character types it draws from. Rather than checking a password against a blocklist of common words, it models the raw size of the guessing space an attacker faces after a password database is stolen. This gives a mathematical floor on password security, useful for setting length and complexity rules rather than judging any single password's real-world safety.

How It Works

You enter a password length and toggle which character categories it includes: lowercase letters, uppercase letters, numbers, and symbols. Each selected category adds its own character count to a running pool size (26 for lowercase, 26 for uppercase, 10 for digits, 32 for symbols), and the calculator raises that pool size to the power of the password length to get the total number of possible combinations. It then converts that count into an estimated cracking time under a fast offline attack and labels the result from Very Weak to Very Strong.

combinations = poolSize^length, where poolSize is the sum of the selected character-type sizes (26 lowercase + 26 uppercase + 10 digits + 32 symbols). Years to crack = combinations / (2 x 10,000,000,000 guesses/second x 31,557,600 seconds/year).

Formula & Methodology

Since an attacker on average finds the correct password after searching through half of the possible combinations, not all of them, the calculator divides total combinations by 2 before dividing by the guessing rate. The assumed rate of 10 billion guesses per second reflects a realistic offline attack against a leaked password hash database, not an online login form, which is normally rate-limited. The resulting seconds figure is divided by 31,557,600 (seconds per year) to get years-to-crack, which is then compared against four thresholds: over 1,000,000 years is Very Strong, over 100 years is Strong, over 1 year is Moderate, over 1 day (1/365 of a year) is Weak, and anything below that is Very Weak.

Examples

Default 12-character mixed password

With length 12 and lowercase, uppercase, and numbers enabled (symbols off), the pool size is 62 characters, giving 62^12, about 3.2x10^21 combinations. Dividing by twice the guessing rate and converting to years puts the crack time at roughly 5,100 years, rated Strong.

8-character lowercase-only password

An 8-character password using only lowercase letters has a pool size of just 26, giving 26^8, about 209 billion combinations. At 10 billion guesses per second that falls to only a few seconds of cracking time, rated Very Weak.

Advantages

  • Turns an abstract idea like 'password strength' into a concrete estimated cracking time you can compare across choices.
  • Shows exactly how much each character category contributes to the total combination space, making the value of adding a symbol or two visible.
  • Lets you test the effect of length changes instantly, useful for setting a minimum password length policy.

Common Mistakes

  • Assuming a long password made only of lowercase letters is automatically strong, when pool size matters as much as length.
  • Treating the estimated crack time as a guarantee, when it only reflects resistance to brute-force guessing and ignores dictionary attacks.
  • Comparing crack-time estimates from different tools directly, when each may assume a different guesses-per-second rate; this calculator's rate is realistic for offline attacks, not a rate-limited login form.

Edge Cases to Watch For

  • If no character type is selected, the calculator returns an error instead of a result, since a pool size of zero makes the combination math undefined.
  • Results beyond 1,000,000 years are simply displayed as 'Millions of years+' rather than the exact number, since a precise figure at that scale has no practical meaning.
  • The estimate only measures resistance to random brute-force guessing; it cannot detect that a password is a dictionary word, a keyboard pattern, or reused elsewhere, all of which let real attackers skip past this theoretical search space.

Common Use Cases

  • Anyone choosing a new password and wanting a quick sense of whether it is long and varied enough.
  • IT administrators setting a minimum password length or complexity policy and wanting to see the security payoff of each rule.
  • Students or curious users exploring how combinatorics applies to everyday security decisions.
Written & fact-checked by the Calculateus TeamLast updated August 5, 2026How we verify our formulas

Frequently asked questions

Why does this assume checking half the total combinations, not all of them?

On average, a brute-force attacker guessing randomly (or systematically) finds the correct password after searching through about half of the total possible combinations, not all of them - some passwords get found in the first few guesses and some near the very end, but half is the statistical expectation across many attempts.

Related calculators

Age CalculatorCalculate your exact age in years, months and days from your date of birth.Date Difference CalculatorCalculate the exact number of days, weeks and months between two dates.Add or Subtract Days CalculatorAdd or subtract days, weeks or months from a date.Day of the Week CalculatorFind out what day of the week any date falls on.

Related articles

How Reading Time Estimates Are Actually CalculatedThat 'X min read' tag on articles isn't a guess — it's based on average reading speed research. Here's the actual formula.Why Word Count Still Matters for Essays, Articles and SEOWord count is more than an arbitrary rule — it signals depth for readers, search engines, and instructors alike. Here's how it's actually measured.How Percentage Scores Convert to Letter GradesGrading scales vary by school, but the standard U.S. conversion follows a consistent pattern. Here's how percentage maps to letter grade.

Conclusion

The Password Strength Checker turns password policy into arithmetic: pool size raised to the power of length, divided by a realistic guessing rate. Used alongside good habits like avoiding reused or dictionary-based passwords, it offers a useful sanity check on whether a password's length and variety hold up against brute-force guessing.