Password Strength Checker
Rates a password by its length, character types, and easily guessed patterns. What you type never leaves your browser and is not stored. If you need a strong one, try the Password Generator.
🔒 Runs in your browser · Your data is never sent to a server
Estimated time to crack (average brute force)
- Online attack (rate-limited, 100 guesses/s)
- Offline attack (fast hash, 10 billion guesses/s)
Checklist
- At least 8 characters
- Has lowercase letters
- Has uppercase letters
- Has numbers
- Has symbols
Things to improve
- Too short. Aim for 12 or more characters.
- This is a commonly used password. Swapping in symbols or digits will not stop it from being guessed quickly.
- This is a common word with digits or symbols tacked on, which is an easily guessed pattern.
- It contains only digits.
- It contains only letters.
- It repeats the same character (for example, aaa).
- It contains a run of consecutive characters (for example, abc or 123).
- It contains neighboring keys in a row on the keyboard (for example, qwerty).
No obvious weaknesses were found.
Notes
- The rating is a rough guide based on length and character types. Real-world safety also depends on whether the password is reused or has appeared in a data breach.
- Crack times are theoretical figures assuming half the search space is tried by brute force. Dictionary attacks and lists of leaked passwords can break a password much faster.
- The common-password check compares against a small built-in list. Not being on the list does not mean a password is safe.
- Avoid typing a password you actually use. This tool does not send your input anywhere, but a screen share or recording could capture it.
- The most effective defense is to never reuse the same password across services.
Glossary
Entropy (bits)
A measure of how hard a password is to guess. Each extra bit doubles the number of attempts a brute-force attack needs.
Brute-force attack
An attack that tries every possible combination of characters until it finds the password.
Dictionary attack
An attack that tries lists of common words and passwords first. A word with digits added on the end falls far faster than brute force would suggest.
Offline attack
An attack against a stolen hash that the attacker can test at full speed with no rate limit. It is orders of magnitude faster than guessing through a login form.
FAQ
Is the password I type sent to a server?
No. The check runs entirely in a script in your browser, and nothing you type is stored. Still, avoid entering a password you actually use, since a screen share or recording could capture it.
Is a password safe if it says "Very strong"?
Not necessarily. This tool only looks at length, character types, and simple patterns. A password that is reused on other services or appeared in a past breach can be broken regardless of its rating.
How are the bits of entropy calculated?
The character types in use (26 lowercase, 26 uppercase, 10 digits, 33 symbols, and so on) set the information per character, which is multiplied by the length. Repeated, sequential, and keyboard-run characters are discounted from the length.
Why might the crack time look too short or too long?
The figures are theoretical average brute-force times under two assumptions: an online attack at 100 guesses per second and an offline attack at 10 billion per second. Real attack speed depends heavily on the service’s protections and the hashing method used.
How are non-English passwords rated?
Characters outside ASCII are treated as drawn from roughly 100 possibilities each. Common words and romanized phrases are easy to guess, though, so the real strength may be lower than shown.
Share this page