Password Strength Checker
100% private — runs on your device, never uploaded. Works offline once loaded.
Type a password to see its length, character variety, estimated entropy in bits, a strength rating and a rough offline crack-time estimate, plus tips to improve it. The password is analysed entirely in your browser and never sent anywhere.
How the strength score is calculated
The checker estimates entropy — a measure of unpredictability in bits — using the classic formula bits = length × log2(pool), where the pool is the size of the character set you drew from: 26 for lowercase, 26 for uppercase, 10 for digits and 33 for common symbols. A 12-character password using all four classes draws from a pool of 95, giving roughly 79 bits. Each additional bit doubles the number of guesses an attacker must try, which is why length matters far more than swapping an a for an @.
On top of the raw calculation, the tool applies penalties for structure that real cracking tools exploit: dictionary words, all-digit PINs, three-or-more repeated characters, and keyboard or numeric sequences like 1234 or qwerty. These patterns make a password far weaker than its length suggests, so the effective entropy is reduced before the final Very weak to Very strong label is assigned.
What the crack-time estimate means
The crack-time figure assumes an offline attack against a fast, poorly-protected hash at about 10 billion guesses per second — the kind of speed a modern GPU rig reaches against unsalted MD5 or SHA-1. On average an attacker finds the password after searching half the space, so the estimate halves the total before dividing by the guess rate.
Real-world numbers vary enormously with the hashing algorithm. A slow, deliberately expensive hash like bcrypt or Argon2 might allow only thousands of guesses per second, making even a modest password hold out far longer, while an online login form throttled to a few attempts per minute is slower still. Treat the estimate as a relative yardstick for comparing passwords, not an exact guarantee.
Building a genuinely strong password
The most reliable path to a strong password is length plus randomness. A passphrase of four or five unrelated random words (think correct-horse-battery-staple) is both easier to remember and harder to crack than a short string of scrambled symbols, because its entropy comes from the huge number of possible word combinations.
- Aim for at least 12 characters — 16 or more for anything important.
- Mix uppercase, lowercase, digits and symbols, or use a long multi-word passphrase.
- Never reuse a password across sites; a breach on one becomes a breach everywhere.
- Let a password manager generate and store long random passwords so you only remember one master phrase.
- Enable two-factor authentication so a stolen password alone is not enough.
Why reuse is the real danger
Most account takeovers do not involve cracking at all — they use credential stuffing, where attackers take username and password pairs leaked from one breached site and try them automatically on hundreds of others. A strong but reused password offers no protection once it appears in a breach. Unique passwords per site, backed by a manager, are what actually stop this attack, which is why the tips here emphasise a manager over memorising clever variations of one password.
Frequently asked questions
Does a longer password beat a more complex short one?
Almost always yes. Because entropy grows with length, adding characters increases the search space faster than adding symbol variety to a short password. A long passphrase typically beats a short scrambled string.
Why does my password with a word in it score low even though it is long?
Cracking tools try dictionary words and common substitutions first, so a recognisable word adds far less real strength than the same number of random characters. The tool penalises dictionary-like structure to reflect this.
What does the entropy number actually tell me?
It approximates the log base 2 of how many guesses are needed. Under 40 bits is weak, 60–80 bits is strong for most accounts, and 80-plus bits is very strong even against offline attacks on fast hashes.
Is it safe to type my password into this tool?
Yes — the analysis happens entirely in your browser with JavaScript, nothing is uploaded, logged or stored, and closing the tab discards everything. As general hygiene, only ever do this in a tool whose privacy you trust.
How often should I change my passwords?
Modern guidance from bodies like NIST is to change a password when you suspect it was exposed, not on a fixed schedule, since forced routine changes tend to push people toward weaker, predictable variations.
Can this tool guarantee my password is uncrackable?
No tool can. It gives a well-founded estimate, but real safety depends on the site's hashing, rate limiting, whether you reuse the password, and whether two-factor authentication is enabled.
Advertisement