How to use the Password Strength Checker
- Type or paste the password into the box. Click Show if you want to see what you typed.
- Read the rating and the estimated entropy. The second figure shows how strong it would be if every character were random.
- Look at Patterns found to see which parts an attacker would guess first, and check the crack-time table.
- Follow the tips, or replace the password with a random one and test again.
Features
- Runs fully offline in your browser; nothing is transmitted
- Detects common passwords, look-alike swaps, sequences and repeats
- Spots keyboard walks such as qwerty and 1qaz2wsx
- Flags years and dates like birthdays
- Crack-time estimates for four realistic attack scenarios
- Specific, plain-language advice for each weakness
Why “complex” passwords are often weak
Many websites tell you to add an uppercase letter, a number and a symbol. People respond in predictable ways: they capitalize the first letter, put a year or a 1 at the end and finish with an exclamation mark. Summer2024! ticks every box, yet password-cracking software tries exactly that shape within seconds. Attackers do not guess character by character; they start with leaked password lists, dictionaries and common patterns, then apply the same tweaks people make. A meaningful strength check has to think the same way.
How this checker estimates strength
The checker first works out the character pool (26 lowercase letters, 26 uppercase, 10 digits, 33 symbols and space) and the entropy the password would have if every character were random: length × log₂(pool). That is the best case. It then searches for patterns and asks how cheaply each part could be guessed:
- Common passwords and words from a built-in list, ranked so that the most popular ones cost almost nothing to guess.
- Look-alike substitutions such as p@ssw0rd, which are undone automatically by cracking tools.
- Dictionary-style words: pronounceable runs of letters are priced as a pick from a large dictionary rather than as random letters.
- Sequences (abc, 6789, zyx) and repeats (aaaa, abcabc).
- Keyboard walks, where each key sits next to the previous one on a QWERTY keyboard, like asdfgh or 1qaz2wsx.
- Years and dates from 1900 to 2049, with or without separators.
It then chooses the cheapest way to build the whole password from these pieces plus random characters, which gives the estimated entropy. The approach is similar in spirit to well-known estimators used by password managers, but simplified so it can run instantly in a single page.
Reading the crack-time table
Crack time is the average number of guesses needed (half of all possibilities) divided by the attacker’s speed. The speed depends on the situation:
| Scenario | Guesses per second | When it applies |
|---|---|---|
| Online, rate-limited | About 0.03 | A website that locks or slows logins after failures |
| Online, no limit | 10 | A poorly protected login form |
| Offline, slow hash | 10,000 | A stolen database protected with bcrypt, scrypt or Argon2 |
| Offline, fast hash | 10,000,000,000 | A stolen database using a fast hash such as unsalted MD5 or SHA-1 |
Plan for the worst row. You cannot know how a website stores your password, and breaches of sites with weak hashing still happen.
What a good result looks like
Below 40 bits a password can fall to an offline attack almost instantly. Around 60 bits it resists casual attacks but not a determined offline one. Aim for 80 bits or more for important accounts. The easiest way to get there is a random password of 14 or more characters, or a passphrase of seven or more random words, from the Password Generator.
No checker can know everything an attacker knows. If a password contains your name, your pet’s name or your street, treat it as weaker than the score suggests, and never reuse a password on more than one site.
Frequently asked questions
Is it safe to type my real password here?
The check runs entirely in JavaScript inside this page. The password is not sent to any server, not stored and not logged. You can load the page, disconnect from the internet and still use it.
Does this tell me if my password was leaked in a breach?
No. It estimates how guessable the password is, but it does not check breach databases. Services such as Have I Been Pwned can check a password using a method that sends only part of its hash.
Why does my password score lower than other checkers?
Simple checkers only count character types. This one also looks for common words, dates, sequences and keyboard patterns, because attackers try those first. A lower, more honest score is the safer guide.
How accurate are the crack times?
They are estimates. Real attack speeds vary with hardware and with how the website stored your password, so treat the figures as orders of magnitude rather than exact times.
What is a good entropy score?
Aim for at least 60 bits for everyday accounts and 80 bits or more for email, banking and your password manager. Every extra bit doubles the number of guesses needed.