Question 1

What does "time to crack" actually mean?

Accepted Answer

It assumes an attacker can compute 10^11 password hashes per second — roughly what a high-end GPU rig can do for a fast hash like MD5 or SHA-256. For slow hashes (Argon2id, bcrypt, scrypt), the actual rate is 10^4–10^6/sec, and time-to-crack is millions of times higher than what we display.

Question 2

Why does my long password score low?

Accepted Answer

Pattern detection. "P@ssw0rd1!" is 11 characters but is a known common-password variant — the search space attackers explore is far smaller than naive entropy suggests.

Question 3

Is the password I type sent anywhere?

Accepted Answer

No. The evaluation runs entirely in the page. There is no network call, no log, no remote dictionary lookup.

Question 4

What is a good entropy target?

Accepted Answer

For online accounts (rate-limited): 60+ bits. For offline-attackable secrets (key passphrases, encrypted file passwords): 80+ bits. For long-term high-value secrets (root keys, recovery codes): 100+ bits.

Question 5

Why does "trustno1" rank so badly?

Accepted Answer

Because it appears in every password breach corpus. The pattern detector recognizes common passwords and substitutes regardless of length or symbol use.

Passwortstärke prüfen