// PASSWORD & PASSPHRASE STRENGTH VISUALIZER — RUNS 100% IN YOUR BROWSER
// INPUT CONSOLE
>
PRIVACY: analysis is 100% local javascript — nothing you type is sent anywhere.
still, good habit: never type a password you actually use into random tools, including this one. use a lookalike.
// PATTERN INTEL — WHAT AN ATTACKER'S TOOLING SEES
awaiting input...
// BREACH EXPOSURE — HAVEIBEENPWNED (OPT-IN)
uses k-anonymity: your password is SHA-1 hashed locally, and only the first 5 hex
characters of the hash are sent to the API. the full password (and full hash) never leave your machine.
// WHY THE TWO NUMBERS DISAGREE
the naive model assumes an attacker brute-forces every combination of your charset — that's the math
most "password strength" meters use, and it's why they overrate things like P@ssw0rd2024!.
real cracking tools (hashcat + wordlists + rules) try dictionary words, keyboard walks, dates, and l33t swaps
first, so anything built from patterns falls orders of magnitude faster than the math suggests.
the fix isn't more symbols — it's more randomness. four or five truly random words beats
a mangled single word every time. length is cheap entropy.