Password strength (offline heuristics)
Reports observable properties of a password, including length, character classes, repeated/sequential/keyboard-row runs, and membership in a small bundled list of ~130 famously common passwords. This is NOT zxcvbn (that needs a dependency this build does not add) and renders no verdict: no breach corpus, no crack-time estimate, "strong"/"weak" is a guess this tool refuses to make.
Runs on your device. The file is never uploaded.
Password strength reports what it can measure about a typed password: length, which of the four character classes appear, unique characters, and the longest repeated, sequential and keyboard-row runs. A naive entropy figure follows, labelled an upper bound because it ignores dictionary words and reuse. No verdict word is printed, since no breach corpus backs one.
Questions
Will it tell me if my password is strong?
No, and that refusal is deliberate. It reports measurable facts and never prints a verdict word like strong or weak, because it has no breach corpus, no crack time model and no grammar aware pattern matching. A score from those ingredients would be a guess dressed up as an analysis.
What does it measure?
Length, which of the four character classes are present, unique character count, the longest repeated character run, the longest sequential run such as abcd or 4321, the longest keyboard row run such as qwerty, a naive charset entropy figure, and whether the password is in its bundled list of 129 famously common passwords.
Is this zxcvbn?
No. zxcvbn is a real library with a dictionary and a guessing model, and it is not bundled here. This tool covers the same intent offline without that dependency, and its own blurb says so rather than implying an analysis it does not perform.
What does the entropy number mean?
It is length times log2 of the character pool implied by the classes you used, counting 33 for symbols. It is labelled an upper bound for a reason: it ignores dictionary words, patterns and reuse, so a long password made of two common words scores high here and would fall quickly to a real guessing attack.
My password is not in the common list. Is that good news?
It is barely news at all. The list holds 129 entries picked for being on every published most common list, and the output says outright that absence proves nothing because it is not a breach corpus. Millions of common passwords are not in it.
Does my password get sent anywhere?
No. It is typed into a field on this page, analysed in this tab, and never transmitted, stored or logged. There is no server side to send it to and no account attached to anything here. That is the reason to check a real password here rather than on a site that posts it somewhere.