Password Strength Checker

Check how well a password resists guessing. You get an entropy estimate, an estimated crack time, and a list of the specific weaknesses found.

Nothing is transmitted. The analysis runs in your browser with no network request. Even so, the safest habit is to test a variation of your password rather than one you actively use anywhere.

How to use this tool

1. Type or paste a password.
2. Read the strength bar, entropy figure, and crack-time estimate.
3. Work through the listed weaknesses.

What it checks

• Length — the single biggest factor, by a wide margin
• Character variety — lower, upper, digits, symbols
• Common passwords — the entries that top every breach corpus
• Repeated characters — aaa, 111
• Keyboard and alphabet runs — qwerty, abcd, 1234
• Embedded years — a very common and very guessable pattern

Length beats complexity

This is the thing most password rules get backwards. Each extra character multiplies the search space; adding a symbol only widens the alphabet a little.

• P@ssw0rd! — 9 characters, looks complex, is in every cracking dictionary. Broken instantly.
• correct horse battery staple — 28 characters, all lowercase, would take longer than the age of the universe.

Four or five random words are both easier to remember and vastly stronger than a short mangled word. Length is what buys you security.

About the crack-time estimate

The figure assumes an offline attack at 10 billion guesses per second — a realistic rate for a well-funded attacker with GPUs, working against a fast hash like unsalted SHA-256.

Real outcomes vary enormously. A site that stores passwords with bcrypt or Argon2 and rate-limits logins is far slower to attack. A site that leaks an unsalted hash database is far faster. Treat the number as a relative comparison between passwords, not a promise.

Note too that entropy assumes the attacker is guessing blind. If your password is a known phrase or a leaked one, it falls immediately regardless of how long it is — which is why the common-password check exists.

Practical advice

1. Use a password manager. It generates and remembers long random passwords so you never reuse one.
2. Never reuse passwords. A breach on any site becomes a breach on all of them. Reuse is the single most exploited weakness in practice.
3. Turn on two-factor authentication. It protects you even if the password does leak.
4. Check for known breaches at Have I Been Pwned — this tool measures guessability, not whether a password has already been exposed.

Related tools

• Password generator — create a strong one
• Random password generator — another take
• Hash generator — how passwords are stored
• JWT decoder — inspect auth tokens

FAQ

Is my password sent anywhere?

No. There is no network request of any kind — you can verify this in your browser's network tab. Nothing is stored either.

Should I test my real password here?

Preferably not, on any site. Test a similar-but-different variation. The advice applies to every online checker, including trustworthy ones, because screenshots and shoulder-surfing are risks the site cannot control.

What is entropy, in bits?

A measure of unpredictability. Each bit doubles the number of possible passwords. Under 40 bits is weak; 60+ is reasonable; 80+ is strong against offline attacks.

Why is my complex-looking password rated weak?

Almost certainly because it is short, or because it is a dictionary word with predictable substitutions. P@ssw0rd is in every attacker's rule set — substitutions add essentially nothing.

Does this tell me if my password has been breached?

No. That requires checking against breach databases. Use Have I Been Pwned for that; this tool measures guessability instead.

Are passphrases really safer?

Yes, when they are long and the words are chosen randomly. Four random words beat a short mangled word on both strength and memorability. A famous quotation does not — it is in the dictionaries too.