Made a password strength checker that runs 100% in the browser:
- Calculates entropy bits and character space
- Estimates crack time for different attack scenarios (online brute force, GPU cluster, nation-state)
- Detects common passwords and keyboard patterns
- Gives specific improvement tips
Nothing is sent to any server. All analysis runs client-side in JavaScript.
The math is straightforward: character_space ^ length = total combinations, then divide by guesses/second for different attack types.
Also includes a list of the top 50 most common passwords to check against.
Feedback welcome — particularly around the crack time estimates. I used 10B guesses/sec for the default GPU scenario, based on hashcat benchmarks for bcrypt.