Password Strength Analyzer — Entropy + Pattern Heuristics (No Breach DB, No Transmission)

Score passwords the way a good strength meter does — Shannon entropy plus the pattern checks that actually predict crackability: a built-in common-password list, keyboard walks (qwerty), sequential runs, repeated characters, and leet-substituted dictionary words (p@ssw0rd → caught). Returns a zxcvbn-style 0-4 score, entropy in bits, offline/online crack-time estimates, and specific improvement suggestions. Up to 200 per run, online, by API, or as an agent tool via Apify MCP.

Read this — what this is and isn't:

• It is an entropy + heuristic analyzer. The dictionary and common-password list are built-in wordlists, not a live feed.
• It does NOT check breach databases (HaveIBeenPwned or similar). A password can score "Very Strong" here and still be in a breach corpus — this tool measures structural strength, not exposure. If you need breach checking, use a dedicated breach service; we will not pretend to be one.
• It never transmits, logs, or echoes your passwords. Analysis is 100% in-process (zero network calls — verifiable in the source), the output contains only metadata (score, entropy, issues), the password is never written to any record, and even the run log prints only the input index. Our release test asserts this: no submitted password may appear anywhere in the output.

What you get

• score (0-4) + strength label ("Very Weak" … "Very Strong")
• entropyBits, charsetSize, length
• crackTimeOffline / crackTimeOnline — humanized ("instantly", "3 centuries") at 10 B/s and 100/s attack rates
• issues — every weakness found (common password, keyboard pattern, dictionary word, too short…)
• suggestions — specific fixes
• Fail-soft: bad input never fails the run — {ok: false, error}, never charged.

Input

{ "passwords": ["hunter2", "correct horse battery staple"], "maxItems": 50 }

Or a single value via password (a secret field — enter it in the console securely, or send via API).

Output (real run — metadata only, no password)

{
  "index": 3,
  "ok": true,
  "length": 16,
  "score": 4,
  "strength": "Very Strong",
  "entropyBits": 104.87,
  "charsetSize": 95,
  "crackTimeOffline": "centuries",
  "crackTimeOnline": "centuries",
  "issues": [],
  "suggestions": ["Looks solid. Use a password manager to keep it unique per site."]
}

Pricing

$0.0004 per password analyzed. No start fee. Bad inputs never charged.

Measured context (2026-08-07): the store's nearest neighbors are breach-database checkers (clearcheck.io $0.4/scan, lofomachines $0.05/item) — a different, more expensive product. As a pure in-process strength analyzer there is no direct paid comparable; pricing is the cost-plus floor of our ladder.

Honest limits

• Heuristic, not a cracking oracle: entropy + pattern rules approximate crackability well for the common weakness classes but can't model every attack. Treat the score as guidance.
• Wordlists are built-in and English-leaning (top-breached passwords, common words, keyboard rows) — a targeted attacker with a custom wordlist is outside any generic analyzer's scope.
• Crack-time estimates assume the stated attack rates; a slow hash (bcrypt/argon2) makes real offline attacks far slower than the "fast hash" figure shown.

FAQ

Does it check if my password was in a data breach? No — deliberately, and it says so up front. That requires a breach database this tool does not touch. Combine with a dedicated breach service if you need exposure checking.

Are my passwords sent anywhere? No. Zero network calls, in-process only, never stored in the output or logs. Still, prefer testing patterns of your passwords rather than live production credentials — good hygiene regardless of any tool's promises.

What's the 0-4 score based on? Entropy bands adjusted down for structural weaknesses (common password → 0; any pattern flaw caps a mid-score at 2). It mirrors the zxcvbn banding developers expect.

Can I audit a list of candidate passwords? Yes — up to 200 per run; records map back to your input order by index, never by content.

Why did some rows come back ok: false? The input couldn't be analyzed (empty after dedupe/normalization). Recorded, never charged — and never containing the value.

Use from code or AI agents

curl -s "https://api.apify.com/v2/acts/EliAI~password-strength-analyzer/run-sync-get-dataset-items?token=$APIFY_TOKEN" \
  -X POST -H 'Content-Type: application/json' \
  -d '{"passwords": ["candidate-policy-example-1", "candidate-policy-example-2"]}'

Agents: connect Apify MCP and call the EliAI/password-strength-analyzer tool.

• Capability: entropy + pattern strength scoring of one or many passwords — NO breach-DB check, NO transmission/logging of the password
• Required input: password (string, secret) or passwords (array)
• Returns: one metadata record per input (indexed, password never included); score + issues summarize it
• Bounded: 200 per run; failures isolate per input
• Side effects: none (fully in-process, zero network calls)