Password Strength Checker

Measure real password strength, not just character variety.

Password to test

Nothing is transmitted — you can disconnect from the internet and this still works.

Show the password

Good practice

Never type a password you actually use into any web page, however trustworthy. Test a password of the same length and structure, or test a new one before you start using it.

What does Password Strength Checker do?

Estimate how strong a password actually is. It calculates entropy from the character set and length, then penalises the patterns attackers try first — dictionary words, keyboard runs, dates, repeated characters and leetspeak substitutions.

How to Use Password Strength Checker

1
Type a passwordOr better, a password of the same shape as yours.
2
Read the scoreEntropy, rating and estimated crack time.
3
Review the warningsEach names a specific weakness to fix.

Key Features

Entropy in bits, calculated from the actual character set and length
Pattern detection: dictionary words, keyboard runs, sequences, dates and repeats
Estimated offline crack time at a realistic attack rate
Specific, actionable weaknesses rather than a vague score
Masked input with a reveal toggle
Works entirely offline — no breach database lookup, no network request

Frequently Asked Questions

Is it safe to type my password here?

Nothing is transmitted — you can disconnect from the internet and it still works. Even so, the safest habit is never to type a live password into any web page. Test a password of the same length and structure, or test a new one before you start using it.

What is password entropy?

A measure of unpredictability in bits, calculated as length × log₂(alphabet size). Each extra bit doubles the guessing effort. Below 40 bits is weak, 60–80 is reasonable, and above 80 is strong against offline attack.

Why is my complex password rated weak?

Because complexity theatre is not strength. "P@ssw0rd!" uses four character types but is a dictionary word with predictable substitutions — a cracker tries those combinations within seconds. Length and genuine randomness matter far more.

How is crack time estimated?

By assuming an offline attack at 10¹¹ guesses per second against a fast hash, which is realistic for a well-funded attacker with GPUs. A properly salted slow hash such as Argon2 would take far longer, but you cannot control how a site stores your password.

Runs in your browser

This tool works with your network connection switched off. Values are produced by the browser Web Crypto API and never leave your device — no request is made, nothing is logged.

How the rest of the site handles data