Checked in your browser. Nothing is sent over the network.
How the estimate is calculated
The calculation counts the size of the character set in use -- lowercase adds 26, uppercase another 26, digits 10, symbols roughly 33 -- and raises it to the power of the length. That gives the number of possible combinations, expressed in bits of entropy.
The time shown assumes an attacker making about ten billion guesses per second, which is realistic for a well-resourced offline attack against a fast hash. Against a properly slow hash such as bcrypt or Argon2 it would take far longer; against an unsalted MD5 database, considerably less.
Why length beats complexity
Every character added multiplies the search space, while adding a symbol only widens the base. Lengthening a password does far more than complicating it.
A twelve-character password of only lowercase letters has more entropy than an eight-character one using every character class. This is why the old advice about substituting symbols for letters was a poor trade: it made passwords hard for people to remember and barely harder for machines to guess.
What this estimate cannot see
The measure is naive by design: it assumes an attacker guesses randomly. Real attacks do not. They start with leaked password lists, dictionaries, common substitutions and predictable patterns.
So "P@ssw0rd123" scores respectably here and would fall in seconds to any real cracking tool, because it is in every wordlist. Likewise a password already exposed in a breach has zero effective strength whatever its length. Treat a high score as necessary, not sufficient -- and never reuse a password across sites regardless of how strong it is.
What actually protects an account
A password manager generating a distinct random password per site, and multi-factor authentication everywhere it is offered. Multi-factor in particular means a stolen password alone is not enough, which covers the most common real failure -- credential reuse after somebody else's breach.
For passwords you must remember, four or five random words are both strong and memorable. The Password Generator on this site produces both styles.
Frequently asked questions
Is my password sent anywhere?
No. The calculation runs entirely in your browser in JavaScript. Nothing is transmitted, logged or stored -- you can confirm this by watching your browser's network tab while typing.
It says centuries. Am I safe?
Only against brute force. If the password is a known or predictable one, or has appeared in a breach, it can fall instantly regardless of what this estimate says.
How long should a password be?
At least sixteen characters when generated randomly. For a passphrase you type from memory, four or five random words.
Should I change passwords regularly?
Current guidance says no. Forced rotation pushes people toward predictable variations. Change a password when there is reason to believe it was exposed.