How to Test Password Strength in the Browser
https://vulnify.app/blog/how-to-test-password-strength

Estimate entropy, crack time, and common-password warnings in the browser with Vulnify. The password is not sent to a scan server.

People pick passwords in a hurry, then reuse them. A strength estimate will not stop that. It will tell you, on your own machine, whether the string you just typed is the kind of secret a fast guesser finishes before you blink. Vulnify’s Password Strength Checker does that in the browser. The password is not sent to a scan server. Type a candidate locally Open the checker and type into the password field. Analysis starts as you type. The page says the analysis runs locally, the password is not transmitted, and it is not logged or stored. You can disconnect after the page has loaded and the estimate still runs. That is also why this is a poor place to type a password you already use on a bank. Use a candidate you are about to adopt, or a fake such as the word password, when you are learning the labels. There is a Show control if you need to see what you typed. Hide it again before you share a screen. How to read the label The labels are Very Weak, Weak, Fair, Strong, and Very Strong. They come from an entropy estimate. The thresholds are 35, 50, 65, and 80 bits. A password on a built-in common-password list is forced to a score of 0, which is Very Weak, even if it looks long enough to fool a person. The crack-time line assumes 10 billion guesses a second against a fast hash. It is a comparison, not a promise about your server, your lockout policy, or an attacker who already stole a slow hash. The page says the figures are estimates, not guarantees. Under the rating you get composition (lowercase, uppercase, digits, symbols) and a weaknesses list. Patterns it calls out include sequences, keyboard walks, repeats, years, dictionary words, and leet substitutions. A common password is marked critical in that list. Short length is called out on its own, because length does more work than a single symbol. What this page will not tell you It does not query Have I Been Pwned or any breach corpus. A Very Strong label can still be a password you reused on a site that was dumped last year. It does not set your account policy, and it does not scan a website. The weak-password fix notes are about what to change in the application. The tools index is where the other local utilities live. Do not treat this page as a vulnerability scan. What the word “password” does on this page Type the word password. The label goes to Very Weak. Entropy sits in the single digits. The weaknesses list says it is an extremely common password, and length is called out as well. That is the common-password list forcing the score to 0. Adding an exclamation point or swapping a letter for a number does not climb out of that hole if the pattern is still a dictionary word, a year, or a keyboard walk. The page names those patterns. Read the list. It is more useful than the adjective. A long passphrase of unrelated words moves the bits. So does the generator on the same page, if you would rather not invent one. Put the result in a password manager. Run the estimate on the new string so you see Strong or Very Strong for the candidate you will actually keep. Then stop. This page has finished its job. It will not set a minimum length on your registration form. It will not scan a website for default admin passwords. The weak-password fix notes are the application side of that problem. The checker is only the local estimate.