Understand your password, not just its strength.
100% Local • Nothing Stored • No Network CallsEnter a password to see strength analysis
Awaiting input
Estimates appear here
Character breakdown awaits
Per-character weakness map
Step-by-step improvement
QWERTY layout analysis
Technical Reference
Engineered and documented by Melalew Mengistu, Cybersecurity Researcher and Web Engineer at MELEX IT.
MelaSec is engineered with a strict local-only processing guarantee. Every character of your password input is analyzed exclusively within your browser using JavaScript. No password, hash, entropy score, or analysis result is ever transmitted to any server, logged to any database, or shared with any third party. The tool does not make any network requests after the initial page load. This design is intentional: password analyzers that send credentials to a remote server — even for "strength checking" — create a secondary exposure risk that defeats the purpose of the tool.
The hashing functions used in the analysis panel (SHA-256, MD5, bcrypt preview) are all computed in-browser using the Web Crypto API for SHA-256 and pure JavaScript implementations for legacy hash formats. No secrets ever leave your device.
Password entropy quantifies how difficult a credential is to guess by brute force. It is calculated using information theory's Shannon entropy formula:
E = L × log₂(R)
Where E = entropy in bits, L = password length, R = size of the character repertoire used
For example, a 12-character password using only lowercase letters (R = 26) has E = 12 × log₂(26) ≈ 56.5 bits of entropy. Adding uppercase, digits, and symbols expands R to approximately 95, giving E = 12 × log₂(95) ≈ 78.7 bits. Each added character class multiplies the search space rather than simply adding to it — which is why a single special character in an otherwise all-lowercase password provides far less protection than distributing diverse character types throughout.
0–28 bitsVery weak — crackable in seconds by modern GPUs using brute force or dictionary attacks28–35 bitsWeak — vulnerable to targeted attacks within minutes36–59 bitsModerate — hours to days with dedicated hardware; acceptable for low-value accounts60–127 bitsStrong — computationally infeasible for all practical offline attacks at current hardware speeds128+ bitsVery strong — equivalent to AES-128 keyspace; recommended for encryption keys and master passwordsNote that the Shannon entropy formula assumes characters are chosen independently and randomly. In practice, humans choose predictable patterns — words, keyboard walks, dates, common substitutions — that reduce the effective entropy far below the theoretical maximum. MelaSec detects these patterns and penalizes the score accordingly.
NIST Special Publication 800-63B (Digital Identity Guidelines, 2017, updated 2020) fundamentally revised how organizations should handle password policies. The key recommendations that security engineers must implement:
Brute force exhaustively attempts every possible combination of characters up to a given length. Modern GPU clusters using tools like Hashcat can test billions of MD5 hashes per second. An 8-character password using all printable ASCII (95 characters) has 95⁸ ≈ 6.6 × 10¹⁵ combinations — feasible for a well-resourced attacker with access to an unsalted MD5 hash. This is why the hashing algorithm used to store passwords matters as much as the password itself. Bcrypt, scrypt, and Argon2 are deliberately slow (and memory-hard for the latter two) to make GPU-accelerated cracking impractical.
Dictionary attacks use wordlists derived from real-world passwords leaked in breach dumps (RockYou, LinkedIn, Adobe), combined with rule-based transformations. Hashcat rules can automatically generate thousands of variations per word: capitalize first letter, append common years, substitute letters with numbers (leet speak), double the word, append exclamation points. A dictionary attack against the password Football2024! succeeds in milliseconds despite technically satisfying typical complexity requirements.
MelaSec's built-in dictionary check tests your input against a curated list of the most commonly used passwords and keyboard walk patterns (qwerty, 123456, asdfgh) directly in your browser — without transmitting anything. This mirrors the server-side check that NIST 800-63B requires authentication systems to perform at enrollment time.
Credential stuffing uses known username/password pairs from one breach to attempt logins on unrelated services. It is effective because password reuse across sites is extremely common. The defense is unique passwords per service — which requires a password manager, since humans cannot memorize dozens of strong unique credentials. MelaSec's strength analysis is most valuable when used to evaluate master passwords for password vaults, where a single credential protects all others.
Modern browsers expose cryptographic primitives through the window.crypto.subtle API (Web Crypto API). This includes SHA-1, SHA-256, SHA-384, SHA-512, HMAC, AES-GCM, RSA-OAEP, and ECDH/ECDSA. All operations are asynchronous and return Promises. Using crypto.subtle is always preferable to JavaScript hash implementations because the browser's native implementation runs in a separate, sandboxed context with access to hardware acceleration and is not visible to same-origin JavaScript via prototype access.
Critical design note: Client-side hashing before transmission does not replace server-side password hashing. If a client sends SHA256(password) to the server and the server stores that hash directly, the hash itself becomes the credential — an attacker who obtains the stored hash can log in by replaying it. Proper password storage always requires a slow, salted algorithm (bcrypt, Argon2id) applied server-side after receiving the plaintext over TLS.