Password Strength Analyzer — Entropy + Pattern Heuristics (No Breach DB, No Transmission)

Password Strength Analyzer scores passwords 0-4 using entropy plus common-password, keyboard-walk and dictionary checks, never stores or sends the password, and costs $0.0004 per password on the Apify Free plan.

• Price: $0.0004 per password analyzed on the Free plan, less on paid plans. An input that cannot be analyzed is not charged.
• Example input: { "passwords": ["hunter2", "correct horse battery staple"] }
• Output fields: index, ok, length, score, strength, entropyBits, charsetSize, crackTimeOffline, crackTimeOnline, issues, suggestions

Score passwords the way a good strength meter does — entropy (length times log2 of the character-set size) plus the pattern checks that actually predict crackability: a built-in common-password list, keyboard walks (qwerty), sequential runs, repeated characters, and leet-substituted dictionary words (p@ssw0rd → caught). Returns a zxcvbn-style 0-4 score, entropy in bits, offline/online crack-time estimates, and specific improvement suggestions. Up to 200 per run, online, by API, or as an agent tool via Apify MCP.

Read this — what this is and isn't:

• It is an entropy + heuristic analyzer. The dictionary and common-password list are built-in wordlists, not a live feed.
• It does NOT check breach databases (HaveIBeenPwned or similar). A password can score "Very Strong" here and still be in a breach corpus — this tool measures structural strength, not exposure. If you need breach checking, use a dedicated breach service; we will not pretend to be one.
• It never transmits, logs, or echoes your passwords. Analysis is 100% in-process (zero network calls — verifiable in the source), the output contains only metadata (score, entropy, issues), the password is never written to any record, and even the run log prints only the input index. Our release test asserts this: no submitted password may appear anywhere in the output.

What you get

• score (0-4) + strength label ("Very Weak" … "Very Strong")
• entropyBits, charsetSize, length
• crackTimeOffline / crackTimeOnline — humanized ("instantly", "3 centuries") at 10 B/s and 100/s attack rates
• issues — every weakness found (common password, keyboard pattern, dictionary word, too short…)
• suggestions — specific fixes
• Fail-soft: bad input never fails the run — {ok: false, error}, never charged.

Input

{ "passwords": ["hunter2", "correct horse battery staple"], "maxItems": 50 }

Or a single value via password (a secret field — enter it in the console securely, or send via API).

Output (real run — metadata only, no password)

{
  "index": 3,
  "ok": true,
  "length": 16,
  "score": 4,
  "strength": "Very Strong",
  "entropyBits": 104.87,
  "charsetSize": 95,
  "crackTimeOffline": "centuries",
  "crackTimeOnline": "centuries",
  "issues": [],
  "suggestions": ["Looks solid. Use a password manager to keep it unique per site."]
}

Pricing

$0.0004 per password analyzed on the Apify Free plan, billed as the password-checked event. Paid Apify plans pay less ($0.00037 Bronze, $0.00035 Silver, $0.00032 Gold, $0.00029 Platinum, $0.00027 Diamond). No start fee. Bad inputs are never charged.

Honest limits

• Heuristic, not a cracking oracle: entropy + pattern rules approximate crackability well for the common weakness classes but can't model every attack. Treat the score as guidance.
• Wordlists are built-in and English-leaning (top-breached passwords, common words, keyboard rows) — a targeted attacker with a custom wordlist is outside any generic analyzer's scope.
• Crack-time estimates assume the stated attack rates; a slow hash (bcrypt/argon2) makes real offline attacks far slower than the "fast hash" figure shown.

FAQ

Does it check if my password was in a data breach? No — deliberately, and it says so up front. That requires a breach database this tool does not touch. Combine with a dedicated breach service if you need exposure checking.

Are my passwords sent anywhere? No. Zero network calls, in-process only, never stored in the output or logs. Still, prefer testing patterns of your passwords rather than live production credentials — good hygiene regardless of any tool's promises.

What's the 0-4 score based on? Entropy bands adjusted down for structural weaknesses (common password → 0; any pattern flaw caps a mid-score at 2). It mirrors the zxcvbn banding developers expect.

Can I audit a list of candidate passwords? Yes — up to 200 per run; records map back to your input order by index, never by content.

Why did some rows come back ok: false? The input couldn't be analyzed (empty after dedupe/normalization). Recorded, never charged — and never containing the value.

Use from code or AI agents

curl -s "https://api.apify.com/v2/acts/EliAI~password-strength-analyzer/run-sync-get-dataset-items?token=$APIFY_TOKEN" \
  -X POST -H 'Content-Type: application/json' \
  -d '{"passwords": ["candidate-policy-example-1", "candidate-policy-example-2"]}'

Agents: connect Apify MCP and call the EliAI/password-strength-analyzer tool.

• Capability: entropy + pattern strength scoring of one or many passwords — NO breach-DB check, NO transmission/logging of the password
• Required input: password (string, secret) or passwords (array)
• Returns: one metadata record per input (indexed, password never included); score + issues summarize it
• Bounded: 200 per run; failures isolate per input
• Side effects: none (fully in-process, zero network calls)

Who uses it

• Signup-form developers scoring passwords with a 0-4 score and suggestions without sending them to a breach service
• Security trainers demonstrating why leet-substituted dictionary words are weak
• IT admins testing a proposed password policy against sample passwords
• QA engineers checking a password meter's behavior on keyboard walks and repeats
• Researchers comparing entropy estimates across password datasets