Password Strength Checker

Test password strength with entropy and crack-time estimates.

🔒 100% private: your password is analyzed entirely in your browser and never sent anywhere.
—
Strength
—
Entropy (bits)
—
Time to Crack*

    *Estimated for an offline attack at 10 billion guesses/second. Online attacks are far slower; leaked-password lists are far faster — never reuse passwords.

    What Does the Password Strength Checker Do?

    This checker analyzes a password as you type and grades it from Very Weak to Very Strong. It calculates entropy (the mathematical measure of unpredictability), estimates how long an offline attacker cracking ten billion guesses per second would need, and runs seven concrete checks: length, mixed case, numbers, symbols, common-password detection, keyboard sequences (123, qwe, abc) and repeated characters. A checklist shows exactly what to improve.

    Everything runs in your browser. The password is never transmitted, stored or logged — analysis is pure client-side JavaScript, so testing even a real password exposes nothing.

    How to Check a Password

    1. Type or paste a password — analysis is instant, no button needed.
    2. Read the strength verdict, entropy bits and crack-time estimate.
    3. Work through the unchecked items in the list — length is the most powerful fix.
    4. Use the 👁 button to reveal what you typed.

    What Actually Makes a Password Strong?

    • Length beats complexity — every added character multiplies the search space; a 16-character phrase crushes an 8-character symbol soup.
    • Unpredictability — "P@ssw0rd!" satisfies complexity rules but tops every cracking dictionary. Patterns humans love, crackers know.
    • Uniqueness — reused passwords fall to credential-stuffing the moment any one site leaks. One site, one password.
    • Passphrases work — four random words ("plum-orbit-canyon-whisk") are long, strong and typeable.

    Frequently Asked Questions

    Is it safe to type my real password here?

    The analysis is 100% client-side — nothing you type leaves your device, which you can verify in the browser's network tab. That said, security best practice is to test a similar-pattern password rather than a live credential.

    What is entropy, in plain terms?

    The number of bits of unpredictability: each bit doubles the guesses an attacker needs. Under 40 bits is weak, 60+ is solid, 80+ is excellent. It is computed from length and the character sets you actually use.

    How realistic is the crack-time estimate?

    It models an offline attack at 10 billion guesses/second against a properly hashed password — a realistic GPU-rig scenario. Online attacks are far slower; leaked plaintext is instant. Treat the number as a comparative gauge, not a guarantee.

    Why is my complex 8-character password rated only Fair?

    Eight characters is simply a small search space in 2026 — even with all four character classes it falls in hours offline. Length is the fix: 12+ characters minimum, 16 recommended.