// How your password falls

Type a password. Watch it get attacked.

It is not just "strong" or "weak". You will see how long it lasts under three real attackers — and why the way it is stored matters as much as the one you pick.

🔒 It never leaves your browser. Nothing is sent to any server.

try:

If the database is stolen (fast hash, 1 GPU) — Start typing above.

Entropy0 bits

a-z lowercase A-Z uppercase 0-9 digits !@#$ symbols

Average time to crack it

🌐 Online form, rate-limited
~100 attempts/sec —

🐢 Stolen DB · slow hash (bcrypt)
~10,000 hashes/sec —

⚡ Stolen DB · fast hash (MD5/NTLM), 1 GPU
~100 billion/sec —

The same password lasts seconds or centuries depending on how it is stored. Look at the gap between the 🐢 and ⚡ rows: that is why slow hashing (bcrypt, scrypt, Argon2) matters as much as your password. If a service leaks its hashes in MD5, your "decent" password falls anyway.

🔑 Generate a strong password 🧰 See the arsenal

Rates are illustrative and attacker-side (consumer/rental hardware). The estimate assumes brute force over the character space; a common or predictable password falls far sooner than its entropy suggests.