Password Strength Meter
Scores a password by information entropy: character-pool size, length, crack-time against an offline attack (10^10 guesses/s), and common-password/pattern detection. Evaluated in memory only, never stored or logged — the honest math behind 'is this password good?'.
Worked examples
A decent passphrase
GET /api/v1/security/password-strength?password=correct-horse-battery-9
Result: Excellent — 140.5 bits · an offline attacker needs billions of years (effectively forever)
A common one
GET /api/v1/security/password-strength?password=qwerty123
Result: Weak — 46.5 bits · an offline attacker needs instantly
Long random
GET /api/v1/security/password-strength?password=rT7%23vQm2%24LpX8%26zK
Result: Excellent — 105.1 bits · an offline attacker needs billions of years (effectively forever)
Machine API (x402)
$0.002 / callThis tool is also a JSON API for AI agents. Requests without payment receive 402 Payment Required plus instructions; agents pay USDC on Base via the x402 protocol — no accounts, no API keys.
GET /api/v1/security/password-strength?password=correct-horse-battery-9 HTTP/1.1
Host: agentstoolshub.com
→ 402 (payment required, instructions in headers)
→ 200 (after X-PAYMENT header; JSON body below)
{
"tool": "security/password-strength",
"input": {"password":"correct-horse-battery-9"},
"result": { "value": 140.5, "answer": "Excellent — 140.5 bits · an offline attacker needs billions of years (effectively forever)" }
}Agent docs: /llms.txt · OpenAPI spec · integration guide
About this tool
Entropy-based password assessment: character-pool size × length in bits, a realistic offline crack-time estimate, and pattern findings (sequences, repeats, known-breach lists). Nothing is stored — this is the calculation security engineers actually do, available as an API for onboarding flows.
entropy = length × log2(charset pool); guesses ≈ 2^entropy / 2
Frequently asked questions
Is my password sent anywhere unsafe?
It arrives over HTTPS, is scored in memory, and is never written to disk, logs, or analytics. Still, best practice is to assess a similar-but-not-real password if you are cautious.
Why cap entropy for patterns?
Sequences and repeated characters shrink the effective search space far below the naive formula, so the meter caps it — the same reason '1234567890' scores terribly despite ten digits.