Password Strength Checker — 100% Offline

Score how strong a password really is, in bulk, without sending it anywhere. This Actor rates each password on entropy, character variety, known-common usage and keyboard patterns — not just "does it have a capital and a symbol".

100% offline: no external call, no breach-database lookup, no API key. And the output never contains the password you sent.

What it does

Each password receives a score from 0 to 4 (very_weak, weak, fair, strong, very_strong), computed from:

• Entropy — length multiplied by the log-2 size of the character pool actually used (26 lowercase, 26 uppercase, 10 digits, 32 symbols).
• A common-password list — 56 embedded entries, the ones that top every public breach-corpus analysis (123456, password, qwerty, letmein…). A match scores 0 immediately, whatever its length or character mix.
• Sequential patterns — abcd, 1234, qwer, asdf and their reverses.
• Repeated characters — three or more identical characters in a row.
• Character classes used — lowercase, uppercase, digits, symbols.

It also returns an estimated crack time, and returns human-readable feedback explaining what is holding the score down.

Use cases

• Onboarding and signup forms — score a proposed password server-side and tell the user why it is weak, not just that it failed a regex.
• Security audits — bulk-score a list of passwords from a policy review and see how many are genuinely weak rather than merely "non-compliant".
• Policy design — test whether your rules actually reject the passwords you think they do. Length rules routinely pass Passw0rd! and reject a strong passphrase.

Input

{ "passwords": ["password123", "Tr0ub4dor&3", "correct-horse-battery-staple-42"] }

Output (one row per password)

{
  "length": 31,
  "score": 4,
  "score_label": "very_strong",
  "is_common_password": false,
  "has_sequential_pattern": false,
  "has_repeated_chars": false,
  "character_classes": 3,
  "estimated_crack_time": "centuries",
  "feedback": [],
  "checked_at": "2026-08-28T17:00:00.000Z"
}

The password itself is deliberately absent from that row.

Pricing

Pay-per-event: $0.003 per password scored, charged once a completed score is produced.

Limitations — read this before you buy

• The crack time is an estimate, not a guarantee. It assumes an offline attack against a fast hash at 10 billion guesses per second. A slow hash such as bcrypt or Argon2 makes the real figure far larger; a leaked plaintext database makes it irrelevant.
• The common-password list is short by design — 56 entries, not a multi-megabyte dictionary. It catches the passwords that dominate real breach corpora, but a password absent from it is not thereby proven unbreached. This Actor does not query Have I Been Pwned or any other breach service; that is precisely what makes it fully offline.
• Entropy is computed from the character pool used, which overestimates strength for a word-based password made only of dictionary words.

Privacy

Passwords are scored in memory and never returned in the output. They do still travel to the platform as run input and appear in your own run's input record — so for a production audit, prefer testing candidate policies over sending live credentials.

FAQ

Why does my 16-character password score lower than a shorter one? Most often a sequential pattern or a run of repeated characters, both of which subtract a point. The feedback field names the reason.

Related Actors

Part of the same family of small, single-purpose checkers on this account — each does one thing, priced per item checked:

• IBAN Validator & Formatter — ISO 13616 length + mod-97 checksum, fully offline.
• Card Number Validator (Luhn) — Luhn checksum and card-network detection, output is masked.
• Barcode Check-Digit Validator — EAN-13, EAN-8 and UPC-A check digits.
• EU VAT Number Checker — official VIES lookup.
• Email Address Validator — syntax, domain and MX checks.
• Cron Expression Validator — plain-English description and next run times.