Question 1

Why is Shannon entropy a better measure of password strength than character count rules?

Accepted Answer

Traditional character composition rules (requiring uppercase, lowercase, numbers, and symbols) encourage predictable patterns like 'P@ssword1!'. Shannon entropy measures theoretical information density (bits) based on character pool size and length, deducted by structural pattern penalties (dictionary words, keyboard walks, repeated substrings).

Question 2

What are the NIST SP 800-63B guidelines for password security?

Accepted Answer

NIST Special Publication 800-63B recommends: (1) Minimum length of at least 8 to 15 characters, (2) Elimination of arbitrary complexity rules (forcing symbols or uppercase), (3) No mandatory periodic password expiration without compromise, and (4) Checking passwords against compromised dictionaries and common patterns.

Question 3

How are password crack times estimated across different threat models?

Accepted Answer

Crack times divide total theoretical combinations by guess rates across three reference threat models: (1) Online Throttled (100 guesses/sec, standard web login with rate limiting), (2) Online Unthrottled (10,000 guesses/sec, unthrottled API endpoint), and (3) Offline GPU Rig (100 billion guesses/sec, dedicated cluster cracking an unsalted fast hash like MD5 or SHA-256).

Question 4

How does dictionary word deduction penalize predictable passwords?

Accepted Answer

When the analyzer detects common dictionary words (like 'admin', 'password', 'welcome'), it caps the effective entropy contribution of the matched word to a dictionary lookup baseline rather than calculating full character pool permutations, reflecting how attackers use targeted wordlists and rulesets.

Question 5

Why is passphrase length more protective than complex 8-character passwords?

Accepted Answer

A four-word passphrase with 20 lowercase letters drawn from a dictionary of 10,000 words provides roughly 53 bits of true entropy and takes years to crack, while an 8-character password with random symbols provides only ~40–45 bits and is vulnerable to GPU-based brute force attacks within hours.

Question 6

Is it safe to test my password in this analyzer?

Accepted Answer

Yes, though testing representative patterns rather than live credentials is good security hygiene. The analyzer executes 100% client-side with zero network calls, input autocomplete is turned off, and inputs are never stored in localStorage or sent to any server.

Analyze password strength and entropy

Estimated Crack Times Across Attack Vectors

Detected Structural Patterns & Vulnerabilities (0)

Developer utility

Frequently asked

Feedback, bugs & custom requests

Related tools