Password Roaster

About Password Roaster

Password Roaster is a password strength checker with a mean streak. Type a password and it rates it TRASH, WEAK, MEH, or OKAY, estimates how long a brute-force attack would take, and roasts your choices, calling out common passwords, repeated characters, numbers-only PINs, and predictable endings like !1. Out of ideas? Generate a goofy hyphenated example passphrase, or copy a shareable report that shows only the password's length. The check runs entirely in your browser: the password is not sent to any server or saved, and your last three tries are kept, masked unless SHOW is on, only while the page is open.

How to use

1. Type a password into the box and brace yourself for the roast.
2. Click SHOW or HIDE to toggle whether the password is visible.
3. Watch the strength meter, read the roast, and check the Predicted Crack Time.
4. Click Use This Instead (Random) for a generated password; it is shown in plain text with a Copy password button. Click Share Roast to copy a report with the password fully masked.
5. Click an entry in Recent Roasts History to bring back a password you tried earlier; entries are masked unless SHOW is on.

Limitations & notes

• Ratings and crack times come from simple length and character-type rules and an assumed 1 billion guesses per second, not breach lists or real attack tools.
• Recent Roasts History keeps your last 3 passwords in page memory until reload and masks them unless SHOW is on.
• Generated passwords combine words from small fixed lists, so even with a secure random source they are easy to guess; do not use them as real passwords.
• Share Roast copies a report that replaces every character of your password with an asterisk and shows only its length.

FAQ

Is it safe to type my real password here?

The password is checked by JavaScript in your browser and the tool makes no network requests, so it never leaves your device and is not stored. Still, good habit: test a password with the same pattern instead of the one guarding your bank account.

How is the crack time estimated?

It estimates entropy from the password length and the character types used (lowercase, uppercase, digits, symbols), then assumes an attacker making 1 billion guesses per second. Real attackers start with dictionaries and leaked password lists, so predictable passwords fall much faster than the estimate suggests.

What makes a password strong?

Length beats cleverness. A passphrase of several random words at 16 or more characters is far stronger than a short word with @ swapped in for a, and you should never reuse it across sites. A password manager makes this painless.

Can I use the generated funny password?

Please do not. It is picked from a small word list, so there are only a few million possible results; it is a joke, not a secure password. Let a password manager generate the real thing.