Password Strength Checker

No. The whole analysis - length, character classes, entropy math, the common-password check - runs locally in JavaScript. Nothing is sent to a server, logged, or saved anywhere, and this tool is registered with sharing disabled by default for exactly that reason.

It's a rough order-of-magnitude estimate, not a guarantee. It assumes an attacker already has your password's hash and is guessing offline at 10 billion guesses/second against a fast, unsalted hash like raw MD5 or SHA-1, then takes half the theoretical keyspace as the average case. A site using a slow hash like bcrypt or Argon2 would take vastly longer to crack for the identical password - and a targeted, informed attacker (who knows your name, pet, or a leaked variant of this exact password) will always beat a pure brute-force estimate.

Symbols are the 32 standard ASCII punctuation characters (!"#$%&'()*+,-./:;<=>?@[\]^_`{|}~). Any character outside printable ASCII - accented letters, non-Latin scripts, emoji - is bucketed into one flat "other" pool allowance of 20 rather than being sized per-script; an emoji and a single accented vowel are treated identically. This is a deliberate simplification applied consistently, not an attempt to model every writing system's real size.

It's an exact, case-insensitive match (optionally with trailing digits, like "password123") against about 50 of the most widely leaked passwords ever published - not a lookup against real breach databases, and not a dictionary of thousands of words. A password that narrowly avoids this list can still be highly guessable; this check only catches the most blatant, best-known cases and forces a Very Weak label when it hits.