Where our numbers come from

Reading time uses 238 words per minute, the average silent reading rate for non-fiction found in the review listed below.

The password checker is this site's own rough method. It cuts the password into the cheapest set of parts and adds up their costs in bits. Parts: very common passwords (a built-in list of 560 entries, ordered most common first), first names (316), common words (373), month and day names (41), keyboard rows, years from 1900 to 2099 (7.6 bits), date shapes (8.6 to 16 bits), runs such as abc or 123, repeats such as aaa or abcabc, look-alike swaps such as @ for a, and digits or symbols added after a word. The lists were written for this site; no breach data is used. Every other character costs log2 of the size of the character set used. Letters that are not on a list but look like words (4 or more letters) cost 13 bits up to 6 letters and 2 bits per letter after that, about 11 bits for a 5.5-letter word, so words typed together without spaces are counted as words and four or more of them make a passphrase. A password made of one to three such listed parts plus digits or symbols is rated Weak at most (word-like text alone never triggers this), one that is 60 percent or more such parts is rated Fair at most, and one under 8 characters is rated Weak at most. A pattern note (first-letter capital, look-alike swaps, digits after a word) is given only for a word that was found in the lists, and a short listed word counts only when it is 30 percent or more of the password. The verdict bands (under 28 bits Very weak, under 36 Weak, under 60 Fair, under 80 Strong, above that Very strong) and all part costs were chosen for this site and are not an official standard.

The rough time to guess is shown only when no pattern was found. It assumes characters chosen at random and ten billion guesses per second, a stated assumption for comparing passwords, not a measurement of any real attacker.

The random tools use the browser's crypto.getRandomValues, with rejection sampling so that no value is favored.

The date tools use the Gregorian calendar and a day-number method (Hinnant's civil-date algorithms). Weeks follow ISO 8601: weeks start on Monday and week 1 holds the first Thursday of the year. Years, months and days are counted by adding whole months to the start date, and a day that does not exist in a month moves to that month's last day.

The loan payment uses the standard fixed-rate formula payment = P x r / (1 - (1 + r)^-n) with r the yearly rate divided by 12. Compound interest uses A = P x (1 + r/m)^(m x t), or P x e^(r x t) for continuous compounding.

MD5 is implemented in this site's own code (the browser has no MD5). SHA-1, SHA-256, SHA-384 and SHA-512 use the browser's SubtleCrypto. Both are compared with Node.js on many inputs before each build.