FormatFlow

Password Strength Checker: Entropy, Security & Crack Time Tester

Evaluate password resilience against brute-force attacks and common dictionary patterns. Calculate crack times across fast GPU rigs and online limits completely in your browser.

100% Client-Side Evaluation: Evaluated in volatile memory, never persisted or logged.
Strength:Fair
57 bits entropy
Fast GPU Brute Force (Offline)
17 days
Assumes 100 billion guesses/sec hashcat rig
Rate-Limited Online Attack
Centuries / Impractical
Assumes 100 attempts/hour lockouts
Complexity Checklist
At least 12 characters
Uppercase letter (A-Z)
Lowercase letter (a-z)
Numeric digit (0-9)
Special symbol (!@#$)
Recommendations:
  • Contains an extremely common sequence easily guessed by attackers.
Have I Been Pwned k-Anonymity Check (Opt-In)

When enabled, FormatFlow hashes your password locally and queries the Have I Been Pwned API using k-Anonymity (only the first 5 characters of the SHA-1 hash are transmitted). Your actual password is never shared.

How to Use Password Strength Checker

  1. Type or paste any password into the evaluation field.
  2. View the real-time strength score (0 to 4), entropy calculation in bits, and estimated brute-force crack times.
  3. Review the complexity checklist (length, uppercase, lowercase, numbers, symbols) and actionable security tips.
  4. Optional: Enable the opt-in HIBP k-anonymity breach check to query whether the password has appeared in known public data leaks.

Practical Examples

Common Pattern Evaluation

Detects simple dictionary patterns and warns user.

Input:
password123
Output:
Score: Very Weak (0/4) | Contains common dictionary word sequence

High-Entropy Random String

Calculates extensive crack times across fast GPU clusters.

Input:
K9#vP3$wL9@mR7!xQ2^z
Output:
Score: Very Strong (4/4) | Entropy: 130 bits | Offline Crack Time: Centuries

Common Mistakes & Troubleshooting

  • Assuming password meters send input to servers: FormatFlow evaluates your password completely inside your browser memory. Nothing is transmitted anywhere unless you explicitly click the opt-in breach check.
  • Relying solely on special character substitution: replacing "e" with "3" or "a" with "@" does not fool modern dictionary attack tools like Hashcat.

Frequently Asked Questions

How long would it take a brute-force attack to crack my password?

Crack time depends on character entropy and attacker computational power. Online attacks are typically rate-limited by login forms (e.g. ~100 attempts/hour), whereas offline attacks on leaked database password hashes using modern high-performance GPU clusters can compute approximately 10^11 attempts per second. Passwords with at least 80 bits of entropy take centuries to brute-force.

What is password entropy and how is it calculated?

Password entropy measures unpredictability in bits using the formula: Entropy = Length × log2(Character Pool Size). For example, a 16-character password drawn from a 94-character pool (upper, lower, digits, symbols) provides ~105 bits of entropy.

What should I do if my password was found in a data breach?

If a password appears in public breach archives, change it immediately across every service where it was used. Never reuse passwords across accounts, and enable two-factor authentication (2FA) or passkeys.

Does FormatFlow store or transmit my password?

NO. All entropy math, pattern scanning, and crack time calculations run 100% locally in your browser. Passwords are never saved, written to disk, or sent to a server.

How does the Have I Been Pwned k-anonymity check work?

If you explicitly choose to check for breaches, the browser calculates the SHA-1 hash locally and sends ONLY the first 5 characters (a 20-bit prefix) to the Have I Been Pwned API. The API returns a list of matching hashes, and the comparison is completed entirely inside your browser. Your password is never revealed to anyone.