A security toy
Password Life Expectancy_
Don't type a password. Describe its shape — how long, what's in it, the little tricks you add on the end — and find out how long it would actually last against someone who wants it.
This tool has no password field, on purpose. Never type a real password into any website, including this one. Describe the pattern instead; the arithmetic works just as well and there is nothing to leak.
Describe the pattern
describe_pattern --no-secrets
About This Tool
Password strength is not about how clever a password looks. It is about how many guesses an attacker has to make, and that number depends almost entirely on how the password was chosen rather than what it contains.
This tool works from a description rather than a secret. You set the shape — the length, the character set, the small rituals most of us perform on the end — and it computes the entropy and the expected time to break it. Because it never sees a password, there is nothing here that could ever leak, and you get to experiment with patterns close to your own without the risk.
How To Use It
- Pick the base structure. Be honest — most passwords in the world are a dictionary word with decoration.
- Set the length and the character set.
- Tick the tricks you actually use. The capital letter at the front, the two digits at the end, the exclamation mark.
- Read the three attack rows. The gap between them is the real lesson, and it is not about you.
Why This Exists
Because the standard advice made everybody worse at this. A generation was taught to build short, complicated passwords full of substitutions, which produced things that are miserable to remember and trivial for software to guess, since cracking tools apply every one of those substitutions automatically as a rule.
The arithmetic points the other way. Length beats complexity, every time. Four random words are stronger than eight random symbols and you can actually remember them. And the single largest factor in whether your password survives is a decision you never got to make: which algorithm the website used to store it.
Frequently Asked Questions
Why does this tool never ask for my password?
Because you should never type a real password into any website, including this one. There is no password field here at all. You describe the shape of a password using switches and sliders, and the tool does the arithmetic on that description, so there is nothing sensitive to leak in the first place.
What are bits of entropy?
Entropy measures how many guesses an attacker would have to make. Each extra bit doubles that number, so 40 bits is a thousand times harder than 30 bits. It depends on how the password was chosen rather than how complicated it looks, which is why a long random passphrase beats a short jumble of symbols.
Why do the three attack times differ so much?
Because the speed of an attack depends almost entirely on how the site stored your password. A rate-limited login form allows perhaps a hundred guesses a second. A leaked database hashed with bcrypt allows a few thousand. A leaked database hashed with an obsolete fast algorithm allows trillions. The same password can be unbreakable in one case and gone in seconds in another.
Do symbol substitutions like a for @ help?
Almost not at all. Cracking software applies those substitutions automatically as standard transformation rules, so replacing letters with lookalike symbols adds only a bit or two of real strength while making the password much harder for you to remember. Length is worth far more than cleverness.
Is a passphrase really better than a complicated password?
Usually yes. Four genuinely random words carry more entropy than eight random characters, and they are far easier to remember. The important word is random, because a phrase you composed yourself from a favourite lyric or saying is guessable in a way that dice or a password manager are not.
Is anything stored or uploaded?
No. There is nothing to store, because you never enter a password. The whole calculation runs in your browser from the switch positions alone, and nothing is transmitted anywhere.
More Games & Tools You'll Love
Speak to the Void →
The other tool here that deliberately refuses to keep anything you give it.
How Rich Are You, Really? →
Another number you have probably never seen calculated honestly.