Password Strength and Offline Crack-Time Estimate
Estimate a trimmed password with zxcvbn, reporting score 0–4, label, UTF-16 length, an offline slow-hash time estimate and feedback. No entropy or breach check.
About this password strength and offline crack-time estimate
Estimate a trimmed password with zxcvbn, reporting score 0–4, label, UTF-16 length, an offline slow-hash time estimate and feedback. No entropy or breach check Runs entirely in-memory using Web Crypto primitives to keep sensitive tokens, certificates, and cryptographic keys secure from third-party interception.
Encoding & cryptographic principles
Passes the trimmed password to zxcvbn and reports its score, fixed label, UTF-16 length, offline-slow-hash display, and brief feedback. This is an estimate and does not enforce NIST policy or check a live breach corpus.
Worked verification example
Scenario: A user checks whether a candidate password appears easy to guess.
Sample input:
Processing: Trims surrounding whitespace, then passes the text to zxcvbn for a pattern-based estimate.
Illustrative output:
Security parameters & input constraints
Leading and trailing whitespace are removed before scoring, so the measured text may differ from what was entered. Length is JavaScript string length, and crack time assumes zxcvbn's offline 10,000-guesses-per-second model. A score is an estimate, not a guarantee against credential theft, leaks, online attacks, or changes in attacker hardware.
Cryptographic digests, encoded strings, and signatures generated by Password Strength and Offline Crack-Time Estimate should be verified against target authentication systems before production use.
Client-side Web Crypto boundary
Key derivation, hashing, and encoding in Password Strength and Offline Crack-Time Estimate execute in local memory using Web Crypto APIs without remote socket transmission.
Cryptographic specifications & RFC standards
Technical specifications and cryptographic RFC standards governing algorithms and key representations:
- zxcvbn Password Strength Estimation Method
- NIST SP 800-63B (Digital Identity Guidelines)
Password Strength and Offline Crack-Time Estimate verification · Audit standards
How to use it
- Enter a candidate password in the input box.
- Run locally to score the trimmed input with zxcvbn's pattern estimator.
- Read or copy JSON with score (0–4), label, trimmed length, estimated offline slow-hash crack time, and feedback.
Frequently asked questions
How is password strength calculated?+
The tool trims leading and trailing whitespace, then evaluates the remaining string with zxcvbn. It returns score 0–4, a fixed label, UTF-16 `length`, estimated offline slow-hash crack time, and feedback.
What can I run locally?+
Enter `password`. After trimming, its UTF-16 length is 8. The result includes a score, label, offline slow-hash time estimate, and feedback; these are heuristic estimates, not a security guarantee.
Does a high score guarantee account security?+
No. It is a heuristic for the supplied string. It cannot assess reuse, breach exposure, MFA, rate limiting, password storage, or account recovery.
Do boundary spaces count?+
No. The primary input is trimmed before analysis, so leading and trailing whitespace does not affect `length` or score. Whitespace inside the trimmed string remains input.