About this password strength checker
Type a password and its strength is evaluated live: the charset size is first estimated from the character classes actually present (lowercase +26, uppercase +26, digits +10, ASCII symbols +33, non-ASCII characters +100) and entropy = length × log2(charset); rule penalties are then applied — a hit against the built-in list of 60 common weak passwords shared across zh/en (123456, password, qwerty, 111111, abc123, 888888…) costs 40 bits, while all-digits, sequential runs (abc/123), repeated characters (aaa) and length under 8 each cost 10 bits, before mapping to weak / fair / strong / very strong.
Crack time is estimated for a brute-force offline attack assuming 10 billion guesses per second (1e10), shown as seconds / minutes / hours / days / years / millennia for the average number of attempts. A show/hide toggle makes the input easy to verify. Everything runs locally in your browser — the password is never sent to any server, stored, or logged.