Password Strength Checker
See how strong a password is and roughly how long it would take to crack. You get its estimated entropy, the weaknesses we spot, and tips to make it stronger — all computed in your browser.
New to this? Read the Password Strength guide →
🔒 Nothing is uploaded — the password is analysed locally and never leaves this tab.
Enter a password to begin.
- Length
- 0
- Entropy (bits)
- 0
- Time to crack
- —
The crack-time estimate assumes a fast offline attack of about 10 billion guesses per second against an unsalted, fast hash. It is a guide, not a guarantee — a strong password is still no substitute for a password manager and two-factor authentication.
Need a strong one? Use the Password Generator →
How to use the password strength checker
- Type a password to see an estimate of its strength and roughly how long it would take to crack.
- Watch how the estimate jumps as you add length versus adding symbols.
- It runs entirely in your browser, so nothing you type is uploaded.
A good habit even so: test variations of the patterns below rather than a password you actually use anywhere.
What strength really means
Strength is measured in bits of entropy, which grow with both length and the size of the character set. Length is the bigger lever: each extra character multiplies the number of possibilities, so a long password from a smaller set usually beats a short one stuffed with symbols. The crack-time estimate assumes an attacker guessing offline after a database leak, which is far faster than guessing through a login form.
How to get a stronger one
- Prefer length. A long random password or a 5 to 6 word passphrase beats a short, cryptic one.
- Avoid predictable patterns like P@ssw0rd!; attackers test those substitutions first.
- Never reuse passwords. Reuse, not weak complexity, is the biggest real-world risk.
Generate a strong one with the password generator, and for the full maths see how long it takes to crack a password.
Frequently asked questions
Is it safe to type my password here?
Yes. The check runs entirely in your browser — your password is never sent over the network, stored, or logged. As a habit, only ever test passwords on sites you trust, or test ones with the same length and character mix as your real one.
How is the crack time calculated?
We estimate the size of the character set you used and combine it with the length to get the number of possible combinations (its entropy in bits), then divide by an assumed guessing speed of 10 billion guesses per second. Real attacks vary, so treat it as a guide.
What makes a strong password?
Length matters most: a long passphrase of several random words beats a short string of symbols. Avoid common passwords, dictionary words, names, dates and keyboard patterns, and use a unique password for every account.
Where you'd use this
Sanity-checking a password policy, or showing someone why the one they have chosen is weaker than it looks. Length beats complexity, and the checker makes that concrete.
For example: "P@ssw0rd!" looks strong — upper, lower, number, symbol, nine characters — but it is a dictionary word with predictable substitutions and falls instantly. Four random words are longer, easier to remember, and vastly harder to crack.