Password Strength Checker
How long a password would actually survive a serious attack, analysed entirely in your browser.
In short
Strength is measured in bits of entropy, not character variety. Length dominates: a 16-character random password is beyond reach, while P@ssw0rd1! falls in under a second because every substitution in it is a known cracking rule.
Last reviewed
Runs entirely in your browser. Nothing you type here is uploaded, stored or logged.
What the score is measuring
Not character variety, unpredictability. Those are different things, and conflating them is why so much password advice made things worse.
The base calculation is length × log₂(pool size), giving bits of entropy.
A 12-character password drawn from the full 94-character printable set carries about 78
bits. Each bit doubles the guesses needed.
But that formula assumes every character was chosen at random. Almost none are. So the score is then penalised for patterns a real cracking tool exploits: dictionary words, keyboard runs, dates, repeats, and the leetspeak substitutions everyone thinks are clever.
Why P@ssw0rd1! fails
It has uppercase, lowercase, digits and a symbol. It satisfies almost every corporate password policy ever written. It falls in under a second.
Every element is a known rule in standard cracking tools:
- Base word from a dictionary of a few hundred thousand entries
- Capitalise the first letter, the overwhelmingly common choice
a → @,o → 0,e → 3,s → $, enumerated automatically- Append a digit, then a symbol, the standard ending
Tools like Hashcat apply these transformations by the billion. A password that follows a human-guessable rule is only as strong as the number of rules, not the number of characters.
Entropy in context
| Bits | Example | Offline crack time* |
|---|---|---|
| ~20 | password1 | Instant |
| ~30 | Summer2024 | Instant |
| ~40 | Tr0ub4dor&3 | Seconds |
| ~60 | 10 random lowercase | Hours |
| ~78 | 12 random mixed | Centuries |
| ~104 | 16 random mixed | Beyond reach |
| ~52 | 4 random common words | Decades |
| ~65 | 5 random common words | Millennia |
*Assuming 10¹¹ guesses per second against a fast hash. Properly hashed passwords using bcrypt or Argon2 take orders of magnitude longer.
The things that actually matter
Length beats complexity. Adding one character to a mixed-case password multiplies the search space by about 94. Adding a symbol to an eight-character one barely registers by comparison.
Randomness beats cleverness. If you invented the pattern, a rule engine has probably enumerated it. Let software generate it.
Uniqueness beats strength. This is the big one. Most account compromises involve no cracking at all. An attacker takes a username and password from one breached site and tries the pair everywhere else. Your strongest password is worthless the moment it's reused on a forum that stores passwords in plain text.
Two-factor beats all of it. A compromised password usually can't get past a second factor. If you do one thing after reading this, turn on 2FA for your email.
What a strength meter can't tell you
This one, and every other, has real limits:
- It can't know if you've reused it. A perfect score on a password used across five sites is a false sense of security.
- It can't know if it's already breached. The offline common-password list is small compared to the billions of real leaked credentials in circulation.
- It can't detect personal patterns. Your dog's name and your postcode look random to a program and are trivially guessable by someone who knows you.
- It can't protect against phishing. If you type it into a convincing fake, entropy is irrelevant.
A high score means the password is hard to guess. It says nothing about the far more common ways accounts are actually lost.
Frequently asked questions
Is it safe to type my password here?
The analysis runs entirely in your browser. Nothing is transmitted, stored or logged, and the page works with your network disconnected. That said, the safest habit is never typing a real password into any website. Test a pattern similar to yours rather than the genuine article.
What does "entropy" mean?
The number of bits of genuine unpredictability. Each bit doubles the number of guesses required. Roughly: under 40 bits is trivially broken, 60 is weak, 80 is decent, and above 100 is beyond brute force with any foreseeable hardware.
Why is my complex password rated weak?
Probably because it follows a predictable pattern. P@ssw0rd1! has uppercase, lowercase, digits and symbols, and cracking tools break it in under a second. The substitutions, the capital at the start and the digit-then-symbol ending are all rules encoded in every wordlist. Length and genuine randomness beat character variety.
How is the crack time estimated?
It assumes an offline attack at 100 billion guesses a second against a fast hash, a well-funded attacker with GPUs and a stolen database. Sites hashing properly with bcrypt or Argon2 are far slower to attack, so the estimate is deliberately pessimistic. If it says centuries, you have real margin.
Does it check breach databases?
Not online, because that would mean transmitting something derived from your password. It checks against a built-in list of the most common passwords and patterns, offline. For a real breach check, use Have I Been Pwned's password service, which uses k-anonymity so the full hash never leaves your device.