Password Strength & Crack Time Meter
Password Strength & Crack Time Meter: Analyzes character diversity (lower, upper, digits, symbols), dictionary words, and calculates crack time against GPU clusters.
About this password strength & crack time meter
Password Strength & Crack Time Meter — browser-based utility.
How this tool works
Passes the trimmed password to zxcvbn and reports its score, fixed label, UTF-16 length, offline-slow-hash display, and brief feedback. This is an estimate and does not enforce NIST policy or check a live breach corpus.
- Token Structure Extraction: Splits JWT strings on '.' delimiters into Header, Payload, and Signature segments.
- Base64URL Decoding: Decodes URL-safe Base64 segments into raw JSON strings without executing unverified signature payloads.
- Claims Parsing & Timestamp Evaluation: Parses registered claims ('exp', 'nbf', 'iat', 'iss', 'aud') and checks current clock validity.
- Cryptographic Status Reporting: Displays token signature algorithm (RS256, HS256, ES256, EdDSA) and warns that client decoding does not verify cryptographic signatures without the public key.
Worked example
Scenario: A user tests the brute-force crack resistance and Shannon entropy of a prospective master password.
Sample input:
Processing: Analyzes character diversity (lower, upper, digits, symbols), dictionary words, and calculates crack time against GPU clusters.
Illustrative output:
Limits and verification
Rejects strings that do not contain exactly two '.' delimiters. Explicitly informs the user that client-side decoding inspects token claims but CANNOT verify mathematical signature validity unless the corresponding public key/secret is supplied.
Examples demonstrate an expected workflow; they do not prove every input or every branch of an external specification. Check important results with an independent source before using them for money, security, compliance, safety, or irreversible file changes.
Browser processing boundary
Tool input is processed by code running in the browser and is not intentionally sent to a CZOA processing API. The page can still request ordinary site assets, analytics, or advertising when those services are enabled. Browser extensions and managed-device software remain outside this tool's control.
Relevant references
These references govern or help explain the format, protocol, or calculation used here. Listing a reference does not claim certification or complete implementation of every optional feature.
- zxcvbn Password Strength Estimation Method
- NIST SP 800-63B (Digital Identity Guidelines)
Content owner: CZOA Tools · Last reviewed: 2026-09-15 · Review methodology
How to use it
- Enter, paste, or select your input data into the Password Strength & Crack Time Meter workspace controls.
- Review available parameter fields, units, formats, or options configured for your task.
- Click the action button or observe immediate live calculations rendered in your browser runtime.
- Inspect the resulting output and any diagnostic messages, then copy or download the result if needed.
Frequently asked questions
How does Password Strength Meter calculate its result?+
It trims input and evaluates it with zxcvbn, returning score 0 through 4, a fixed label, length, an estimated offline crack-time display, and feedback.
What did the browser fixture verify?+
correct horse battery staple returned a structured result with an integer score in the documented range, length 28, and feedback text.
Does a high score guarantee security?+
No. The score is a heuristic estimate for the supplied string. It cannot assess password reuse, breaches, MFA, rate limits, storage, or account recovery.
Are leading and trailing spaces included?+
No. The primary input is trimmed before analysis, so deliberate boundary spaces do not contribute to measured length or score.