Password Strength Checker

Check your password's entropy, estimated crack time and whether it's been commonly used. Nothing leaves your browser.

Advertisement
Enter a password to test
Tips for a stronger password
  • Use a password manager to generate and store long, random passwords.
  • Aim for 16+ characters where the site allows it - length matters more than complexity rules.
  • Never reuse a password across more than one account.
  • Turn on two-factor authentication (2FA) wherever it's available.
  • Avoid personal details like birthdays, pet names or your address.
Frequently Asked Questions

No. Everything happens locally in your browser using JavaScript - your password is never transmitted, logged, stored or sent to any server, including ours. You can check this yourself by disconnecting from the internet and the tool will still work.

Entropy measures how unpredictable a password is, in bits. It is estimated from the password's length and the variety of character types used (lowercase, uppercase, numbers, symbols). Roughly speaking, every extra bit of entropy doubles the number of guesses an attacker would need to make on average.

Crack time is estimated as half the total possible combinations (2^entropy / 2, the average case) divided by an assumed guessing speed. The speeds shown range from a throttled online login form (slow) to an offline GPU attack against a fast, unsalted hash (extremely fast). Real-world cracking speed depends heavily on how the password is stored - a well-salted, slow hash like bcrypt or Argon2 is far more resistant than a fast hash like plain MD5.

Length matters, but predictable patterns reduce real-world strength. This tool reduces the effective score for sequential runs (abcd, 1234, qwerty), repeated characters (aaa, 111), and it checks the password against a list of the most commonly used and breached passwords - these are guessed first by attackers regardless of length.

A long, random password - ideally 16+ characters generated by a password manager - beats a shorter "clever" one every time. Avoid personal information, dictionary words and keyboard patterns, use a different password for every account, and turn on two-factor authentication wherever it is offered.
Related Tools
Privacy

Your password is analysed entirely in your browser using JavaScript. It is never transmitted over the network, logged or stored anywhere.