Password Strength
See how strong a password really is, and how long it would take to crack.
About this password strength checker
Type a password and get an honest assessment: how many bits of entropy it carries, how long it would survive a realistic offline attack, and โ most usefully โ which specific patterns are dragging its score down.
It checks against the passwords that top every breach corpus, spots keyboard runs like
qwer and 1234, catches repeated characters, notices trailing years,
and recognises the Capital-word-then-digits-then-symbol shape that corporate password rules
push everybody into.
Nothing you type here leaves your browser
This matters more than any feature. The entire check runs as JavaScript inside your own tab: there is no request to a server, no analytics event carrying the password, and nothing stored. You can open the page, disconnect from the internet, and it keeps working โ which is the simplest way to prove the claim to yourself.
That said, a general principle is worth stating: do not paste a password you actively use into any website, including this one. Test a password of the same shape instead. The advice is not about this page in particular; it is that you cannot verify what any page does, so the safe habit is to never form the habit.
What entropy actually measures
Entropy counts how many guesses an attacker needs, expressed in bits, where each extra bit doubles the work. A password drawn genuinely at random from the 95 printable ASCII characters earns about 6.5 bits per character, so twelve random characters is roughly 78 bits โ out of reach today.
The catch is the word random. P@ssw0rd uses four character classes and
scores well on a naive counter, but it is one dictionary word with predictable substitutions,
so its real entropy is close to nothing. Cracking tools apply those substitutions
automatically, along with capitalising the first letter and appending a year. This checker
models those rules and marks the score down accordingly โ which is why a long passphrase
usually beats a short password bristling with symbols.
The crack time assumes the worst realistic case: the attacker has stolen the password database and the site hashed badly. A site using bcrypt or Argon2 slows them by a factor of a million, but you have no way to know which sites did โ so assume none of them did. To create something better, use the password generator.
Frequently asked questions
Is it safe to type my password into this checker?
The check runs entirely in your browser with no network request, so nothing is transmitted. Even so, the safe habit is never to paste a password you actually use into any website โ test one of the same shape instead.
How long should a password be?
Length beats complexity. Twelve genuinely random characters, or four to five unrelated words, puts you comfortably out of reach of an offline attack.
What does 'entropy in bits' mean?
It is how many guesses an attacker needs, on a logarithmic scale: each extra bit doubles the work. Under 40 bits is weak, 60 is reasonable, 80 and above is strong.
Why does my complex password score badly?
Because complexity is not randomness. A dictionary word with digit substitutions and a year on the end matches patterns that cracking tools try first, so its real entropy is far lower than the character count suggests.
Is a passphrase better than a password?
Usually. Several unrelated words are easier to remember, easier to type, and often carry more entropy than a short string of symbols you had to write down anyway.