Password Strength Checker
Type a password to see how it would hold up: estimated entropy, time for serious offline cracking hardware, and the specific weak patterns inside it. The analysis happens in this tab and the password is never stored or sent.
Check a password
What weakens it
How to improve it
Private by design. This page has no backend and, unlike most tools on this site, it stores nothing — a password checker that remembered passwords would be a liability. Close or reload the tab and the password is gone.
How the score is calculated
The starting number is raw entropy: length × log2(pool size), where the
pool counts which character types you used. From there the score is reduced for the
patterns cracking software tries first, because a password with those patterns has
far fewer effective possibilities than its length suggests.
What gets penalised
An exact or embedded match against a list of the most-breached passwords (with
leetspeak normalised, so P@ssw0rd! is seen for what it is) collapses the
score. Familiar dictionary words, keyboard walks like qwerty or
1qaz, character sequences like abcd, repeated characters,
short all-digit passwords, and the capitalised-word-plus-number pattern all cost
entropy — less catastrophically than a known password, but honestly.
What the bands mean
Under 28 bits is very weak — broken in moments offline. Under 36 is weak, under 60 fair, and 60–128 strong: the range where brute force stops being realistic and phishing or reuse become the real risks. Above 128 is excellent — more entropy than any realistic attack can search, ever.
What this tool cannot know
It cannot see whether you reused this password on another site (the most common real-world failure), whether the site storing it hashes it properly, or whether someone is watching you type. A strength score covers only one of the ways a password fails. Use a password manager and unique passwords per site.
Common uses
Checking a password before committing to it, testing how much your "trick" actually adds, auditing the strength of passwords you are about to rotate, and teaching what cracking software really responds to.
How to use the Password Strength Checker
- Type or paste the password you want to test.
- Watch the strength rating, estimated entropy and crack time update.
- Read the specific weaknesses flagged, such as dictionary words or keyboard patterns.
Frequently asked questions
Is the password I test stored or sent?
No. It is analysed in your browser and never stored or transmitted.
What does the crack-time estimate mean?
It is an offline estimate of how long a fast attacker guessing billions of candidates per second would need.
Why is a long but simple password weak?
Length helps, but predictable patterns like a dictionary word plus '123' are cracked far faster than their length suggests.