Password strength checker
Type a password and see how it really holds up — its entropy, an estimate of how long it would take to crack, and the weak spots worth fixing. Every check happens on your device.
How the strength test works
Measures the pool
It looks at which character types you used — lowercase, uppercase, digits, symbols — to work out how large the set of possible characters is.
Calculates entropy
Length multiplied by the base-2 logarithm of that pool gives the raw entropy in bits, the honest measure of how many guesses an attacker faces.
Penalizes patterns
Common passwords, sequences like 123, and repeated characters are discounted, because attackers try those first. The verdict reflects the realistic strength, not the ideal.
Reading the results
Entropy in bits
Each bit doubles the effort to crack a password. Under 40 bits is weak, 60 is a reasonable floor, and 80 or more is strong for almost any account you will ever open.
Two crack-time estimates
"Online" assumes a rate-limited login at around a thousand guesses a second. "Offline" assumes a leaked database attacked at ten billion guesses a second — the worst realistic case.
The warnings
Flags point at exactly what drags a password down: too short, one character type, a dictionary hit, or an obvious sequence. Fix those and the score climbs.
What this tool can and can't tell you
A strength estimate is a model, not a guarantee. This checker rewards length and variety and penalizes the patterns attackers exploit most, which makes it a reliable guide for everyday choices. But no lightweight tool can know every wordlist, every leaked-password database, or every clever rule an attacker might run. Treat the result as a floor, not a ceiling.
Why length dominates
Because entropy scales with length, a long password made of only lowercase letters can easily beat a short one packed with symbols. If you take one thing from the numbers here, make it this: add characters before you add complexity.
The trap of "clever" substitutions
Swapping a for @ or o for 0 feels secure, but cracking tools apply those exact substitutions automatically. They add almost nothing to real strength. Genuine unpredictability — from a generator or a random passphrase — is what actually protects you.
A note on testing real passwords
This page never transmits what you type; the analysis runs in JavaScript on your own machine, and you can confirm it by testing with your network disconnected. As a general habit, though, avoid pasting your active passwords into any website you do not control. Use this to learn what strong looks like, then generate fresh passwords for your accounts.
Frequently asked questions
Is my password sent to a server?
No. The entire analysis runs in your browser with JavaScript — there is no network request involved in checking a password. You can disconnect from the internet after the page loads and it will keep working, which is the simplest way to prove nothing is transmitted.
How is the crack time estimated?
We convert the estimated entropy into a number of guesses, then divide by an attack speed. The online figure assumes about a thousand guesses per second against a rate-limited login; the offline figure assumes ten billion per second against a stolen hash. Real speeds vary with the hashing algorithm and hardware.
Why did my complex-looking password score low?
Most likely it is short, uses only one or two character types, or matches a common password or an obvious pattern like a sequence or repeated characters. Substitutions such as writing "P@ssw0rd" do not help, because attackers test them by default. Add length and genuine randomness.
What entropy should I aim for?
Aim for at least 60 bits for ordinary accounts and 80 or more for important ones like email and banking. A generated 16-character password or a five-to-six-word passphrase comfortably clears those marks.
Does a higher score mean my password is definitely safe?
It means it resists brute force well, but safety also depends on not reusing it and on enabling two-factor authentication. A strong password on ten sites is still one breach away from trouble — use a unique one everywhere.
Should I test my current passwords here?
The tool is safe because it runs locally, but a good habit is to avoid entering live passwords into any site. Use it to understand strength, then create new, unique passwords with the generator and store them in a password manager.