Password Strength Checker
Type a password and this estimates how much guessing work it represents, in bits of entropy, then explains what is holding that number down. It reads the character types you used and subtracts for the patterns guessing tools try first: repeats, straight runs, keyboard rows, years, and a short list of very common passwords. Nothing you type ever leaves your browser.
Nothing is sent anywhere. The password is read by JavaScript running in this tab, is never uploaded, stored or logged, and disappears when you close the page. The strength figure is an estimate: it counts the character types you used, then subtracts for patterns it recognises — repeats, straight runs like 1234 or abcd, keyboard rows like qwerty, a year in the 1900s or 2000s, and a built-in list of 40 very common passwords. It has no dictionary of real words, names or leaked passwords, so it will call some guessable passwords stronger than they are. Any time-to-crack figure shown is an order-of-magnitude illustration at 10 billion guesses a second, not a prediction.
How to check a password's strength
- Type or paste the password into the box — use Show if you want to see what you typed.
- Read the strength band and the estimated entropy in bits, which update as you type.
- Work through the weak points and suggestions, editing the password until the estimate stops improving.
When you'd use this
- Before you commit to a new password — See whether the one you just invented is genuinely hard to guess or only looks that way.
- Understanding what actually helps — Watch the bits move as you add length versus adding a symbol, and see which change matters more.
- Auditing an old password — Check something you have used for years against the patterns that make passwords easy to guess.
- Explaining password rules — Show a colleague or a family member why 'Summer2024!' scores badly despite meeting every rule a site asks for.
Good to know
- Entropy is an estimate, not a guarantee — The figure assumes an attacker who knows which character types you used and searches that space. A password that scores well here can still be weak if it is a phrase somebody could guess about you.
- There is no dictionary behind it — Pattern checks cover repeats, sequences, keyboard rows, years and forty very common passwords. It knows nothing about real words, names, sports teams or breached password lists, so it will over-rate a guessable word.
- Length beats complexity — Every extra character multiplies the search space, while adding one symbol to a short password barely moves it. That is why a long passphrase usually scores higher than a short scramble of symbols.
- The time figure is an illustration — It assumes a flat 10 billion guesses a second against the stored password. Real speed depends on how the site hashed it, which can vary by many orders of magnitude in either direction.
Frequently asked questions
Is my password sent anywhere?
No. The password is read by JavaScript inside this page, and there is no upload, no storage and no logging anywhere in the tool. Closing the tab leaves nothing behind, and the result line never contains the password itself.
What does 'bits of entropy' mean?
It is a way of counting how many guesses an attacker would need. Each extra bit doubles that number, so 60 bits is roughly a thousand times harder to guess than 50 bits. The bands here run from very weak below 28 bits to very strong at 80 and above.
Why did my password score badly when it meets every site rule?
Site rules count character types; this counts predictability. A password like 'Password2024!' has an uppercase letter, a digit and a symbol, but it is a common word followed by a year, so most of it is guessed almost immediately.
Why does adding a symbol barely change the score?
One symbol widens the pool of characters per position slightly. Adding a whole character multiplies the number of possible passwords instead, which is a far bigger effect. Length is nearly always the better move.
Should I paste a password I actually use?
It is safe here in that nothing is transmitted, but as a habit it is worth being cautious about typing real passwords into any site. If you would rather not, test a password built the same way instead — same length, same character types, same style of pattern.