Password Check
Calculate entropy and strength locally and check against Have I Been Pwned via k-anonymity.
EntropyHIBPCrack time
Only the SHA-1 prefix is sent directly from your browser to the Have I Been Pwned range API.
Everything else is calculated locally (k-anonymity, 5 hex characters, padded response). The D4rC server never receives your password.
Password
Enter a password to analyse it.
0 bits
Entropy
Length0
Pool0
Unique0
- Theoretical entropy
- –
- Effective entropy (patterns penalised)
- –
- Shannon entropy
- –
a–z
A–Z
0–9
Symbols
Unicode
Theoretical entropy = length × log₂(pool). It assumes random characters; real passwords with words or patterns are much weaker, which the effective value reflects.
Have I Been Pwned
Not checked yet.
Findings
- Enter a password to analyse it.
Estimated time to crack
Online, rate-limited
–
100 guesses / hour
Online, unthrottled
–
10 guesses / second
Offline, slow hash
–
bcrypt / Argon2 · 10,000 / s
Offline, fast hash
–
MD5 / SHA-1 on GPUs · 100 billion / s
Average time (half the search space) based on the effective entropy. Breached passwords are cracked instantly regardless of entropy.