Please recommend a Password or passphrase strength tester. It should preferably:

  • be used off-line (but on-line answers are also fine)
  • display the entropy
  • be open-source
  • be available on Linux (although cross-platform solutions are more than welcome)
  • Did you do your homework? Google has 441000 hits on 'password strength tester linux'. What are you missing in the first 20 of these that is an absolute requirement?
    – user416
    Nov 5 '14 at 8:47
  • 1
    Whoa! Isn't this a place for asking questions? Relevant questions? What is wrong with having a place that catalogs such tools, with users giving their experience and impressions? I even provided an answer myself, for crying out loud. Different tools have different strengths and weaknesses, and answers here would probably document that. What is it that you complain about?
    – landroni
    Nov 5 '14 at 12:05
  • 1
    @Downvoters: Why?
    – landroni
    Nov 6 '14 at 8:07
  • 2
    Meta discussion about this question.
    – unor
    Nov 6 '14 at 14:31

You seem to be under the delusion that password strength checkers actually exist. That's wrong: it is impossible to check the strength of a password, only the strength of a password generation method.

A password strength checker can only test how long it would take to a particular cracker to find the password. A different cracker using a different strategy would take a different amount of time.

Or, in the words of Security Stack Exchange acclaimed expert Thomas Pornin:

Password strength checkers are good at telling you how robust your password is against incompetent attackers. This has some value, if only because there are so many incompetent wannabe hackers. But it would be a mistake to rely too much on such tools.

See also other Sec.SE questions on the topic, including

If you want to know about your own passwords, then you know how they were generated. Calculate the entropy, i.e. the amount of randomness that goes into the password generation process (How can I create a secure password? may help).

If you're an administrator and you want to assess your users' passwords, there may be some value in rejecting passwords that are too weak. pam_cracklib is commonly used for that.


One solution is rumkin.com's password strength checker:

  • it can be used off-line (and on-line)
  • displays the entropy of passwords
  • released under GPL3
  • it is cross-platform and can be used in any web browser
  • 2
    A password strength checker cannot possible display the entropy of the password, since the entropy depends on how the password was generated, not on what the password is. Example: this checker says that aaaaaaaaaaaaaaaa is strong (it's a repeated letter, so it has at most 4 bits of entropy for the length and 4.7 for the choice of letter), and xMLOc6C is weak (even though it has 41.6 bits of entropy, being 7 random alphanumeric characters). Nov 7 '14 at 5:31

Not the answer you're looking for? Browse other questions tagged or ask your own question.