How Password Strength Testing Works

CyberCrack simulates how a real attacker would attempt to crack your password using brute-force methods. Here's the science behind it.

What is a Brute-Force Attack?

A brute-force attack tries every possible combination of characters until the correct password is found. Modern GPU clusters can attempt 10 billion guesses per second. CyberCrack uses this real-world benchmark to estimate how long your password would survive.

Character Sets & Combinations

The total combinations an attacker must try depends on your character set size raised to the power of your password length:

• Lowercase only (a-z): 26 characters
• + Uppercase (A-Z): 52 characters
• + Numbers (0-9): 62 characters
• + Symbols (!@#$...): 95 characters

A 6-character lowercase password has 26^6 = 308 million combinations. At 10 billion guesses per second, that's cracked in 0.03 seconds. A 16-character password using all character types? That's 95^16 = 4.4 x 10^31 combinations — taking over 140 billion years.

What is Password Entropy?

Entropy measures the randomness of your password in bits. Higher entropy means more unpredictability. CyberCrack calculates it as log2(charset_size ^ length). A password with 80+ bits of entropy is considered highly secure against modern attacks.

Pattern Detection

CyberCrack applies penalty multipliers when it detects common weaknesses:

• Common passwords: Words like "password", "123456", and "qwerty" are checked against a database of the most commonly breached passwords.
• Sequential characters: Patterns like "abc", "123", or "xyz" significantly reduce effective entropy.
• Keyboard patterns: Sequences like "qwerty" or "asdf" are among the first patterns attackers try.
• Repeated characters: "aaa" or "111" provide almost zero additional security.

Password Best Practices

• Use at least 12-16 characters
• Mix uppercase, lowercase, numbers, and symbols
• Avoid dictionary words and personal information
• Use a unique password for every account
• Consider passphrases: "correct-horse-battery-staple" is both strong and memorable
• Use a password manager to store complex passwords securely

100% Private & Secure

CyberCrack performs all analysis directly in your browser using JavaScript. Your password is never sent to any server. The password generator uses the Web Crypto API for cryptographically secure random generation.