Password Strength Checker
Test how strong your password is.
About Password Strength Checker
Type a password and three things update at once: a five-condition score bar, an estimate of how long two different kinds of attacker would need, and a checklist showing which conditions you have met. Everything is computed in this tab — there is no request, no logging and no storage.
How the score and the entropy are worked out
The bar counts five conditions: getting past eight characters, getting past twelve, and including an uppercase letter, a digit and a symbol. The entropy figure is calculated separately and more formally. It builds an alphabet from the classes you actually used — 26 for lowercase, 26 for uppercase, 10 for digits, 32 for symbols — and multiplies the length by the base-two logarithm of that alphabet size. Dividing the resulting number of possible passwords by a guessing rate gives the two crack-time columns: a throttled 1,000 guesses per second for an online attack against a live login, and 10 billion per second for an offline attack on a stolen password database.
Read the numbers sceptically
Every calculation above assumes your password was generated at random. Human-chosen passwords are not, and the gap is enormous. Type Password1! into the box and it scores Strong with a crack time measured in centuries, because it is ten characters long and ticks four boxes. A real attacker would find it almost immediately: it is a dictionary word with the most predictable possible decorations, and it sits near the top of every leaked-password list. Twenty repeated letters produce a similarly absurd result. The maths is correct; the assumption behind it is not.
The error runs the other way too. A passphrase of four ordinary lowercase words carries far more real entropy than any twelve-character mixed-case string, but it collects no points for uppercase, digits or symbols, so the bar only reaches Moderate. When the bar and the entropy figure disagree, the entropy is the better guide — as long as the words were chosen by dice or software rather than by you, since a memorable phrase from a song or a film is a dictionary entry of a different kind.
Why the two attack columns differ so much
Ten million times, to be exact. Against a well-built login form, guessing is throttled by rate limits, lockouts and network latency, so even a mediocre password survives. Once a database leaks, none of that applies: the attacker has the hashes locally and can try billions of candidates a second on commodity hardware. Which figure matters to you depends on how the service stored your password, something you cannot see — an unsalted fast hash is far worse than the offline column suggests, while bcrypt, scrypt or Argon2 deliberately slow each guess down by orders of magnitude. Assume the pessimistic column, because you will not be told when the leak happens.
What this page cannot tell you
It does not know whether your password has appeared in a breach, whether you have used it somewhere else, or whether it is a common phrase. Checking any of those would require sending something derived from the password over the network, and this page deliberately makes no requests — so the check is impossible here by design rather than by omission. Reuse in particular is the risk this meter is blindest to: a password that scores Very Strong is worthless the moment it is shared with a site that gets compromised.
Practical advice, briefly
Let a password manager generate long random strings and store them; you never need to read or type them, so length costs nothing. Where you must memorise one, use five random words. Never reuse a password across sites, and turn on multi-factor authentication wherever it exists — it keeps an account safe even after the password is known. Finally, note that the input on this page is deliberately unmasked so you can watch the score respond: that makes it a poor place to type a real, current password in an open-plan office or on a shared screen.
Two Attack Models, Not One Verdict
The entropy figure is turned back into a count of possible passwords, which is then divided by a throttled online rate of a thousand guesses a second and by an offline rate of ten billion. The gap between the two columns is the whole reason a password can be fine for a website login and useless once a database leaks.
Shows The Working
A four-item checklist marks off eight characters, uppercase, digit and symbol as you type, so the bar is not a black box. It covers four of the five conditions the score counts — the extra point for passing twelve characters has no row — and the length row ticks at exactly eight while the score waits for a ninth character.
Typed And Discarded Locally
The arithmetic is a handful of regular expressions and a logarithm running in this tab. No request is made, nothing is stored, and reloading the page leaves no trace of what you typed.
Frequently Asked Questions
How is the strength bar calculated?
Five conditions each add a point: passing eight characters, passing twelve, containing an uppercase letter, containing a digit, and containing anything that is not a letter or digit. One point or none reads Weak, two or three reads Moderate, four reads Strong and all five reads Very Strong. It is a rubric, not a measurement — it counts categories rather than judging the actual password.
Where does the entropy number come from?
It assumes each character was drawn at random from an alphabet built out of the character classes you used: 26 for lowercase, 26 more for uppercase, 10 for digits and 32 for symbols. Entropy is then the length multiplied by the base-two logarithm of that alphabet size. A ten-character password using all four classes scores about 65 bits on this model.
Why does Password1! come out as Strong?
Because it satisfies four of the five conditions and the entropy model has no idea it is a dictionary word with predictable decorations. This is the central weakness of every character-class strength meter, and it is worth seeing plainly: the tool reports centuries to crack, while a real attacker running a wordlist with common substitution rules would find it in well under a second. The maths assumes randomness that a human-chosen password does not have.
So how much should I trust the crack-time estimates?
Treat them as an upper bound that only applies if the password really was generated at random. For anything you invented yourself, assume the true figure is dramatically lower, because attackers do not guess character by character — they start with leaked password lists, dictionary words, keyboard walks, names and dates, then apply substitution rules. Twenty repeated letters also reports centuries here and would fall instantly in reality.
Why did my long passphrase only score Moderate?
Because the rubric rewards character variety, and a passphrase of lowercase words contains no uppercase, digits or symbols. Four random words are genuinely excellent — the entropy figure shown alongside will be far higher than any twelve-character mixed-case string — but it only collects the two length points. When the bar and the entropy disagree, believe the entropy, provided the words were chosen randomly rather than by you.
What do the two attack columns represent?
The Online column assumes a thousand guesses per second, which is what an attacker faces against a service that rate-limits and locks accounts. The Offline column assumes ten billion per second, which represents someone who has stolen the password database and is attacking the hashes with GPUs. That figure is deliberately pessimistic and depends entirely on the hash the site used: a fast hash like unsalted SHA-1 is far worse, while bcrypt, scrypt or Argon2 slow an attacker down by orders of magnitude.
Does it check whether my password has been in a breach?
No, and that is the most important thing it does not do. There is no lookup against known-compromised password lists, because that would mean sending something derived from your password over the network and this page makes no requests at all. A breached password is unsafe no matter how strong this meter says it is, so check separately using a service that supports a privacy-preserving range query, or rely on the breach warnings built into your password manager and browser.
The box shows my password in plain text — is that a problem?
It is deliberate, so you can see what you are typing and how each change moves the score, but it does mean the value is visible to anyone looking at your screen and to any screen recording or shared session. Do not use this on a shared or projected machine, and prefer testing a pattern similar to your real password rather than the real one itself.
What actually makes a password strong?
Length and genuine randomness, in that order — and never reusing it. A password manager generating twenty random characters per site beats any rule you can follow by hand, because the weakness in human-chosen passwords is predictability rather than composition. If you must remember it, use four or five words picked by dice or software rather than by you. And wherever it is offered, turn on multi-factor authentication: it protects the account even when the password is already known.
Is anything I type recorded?
No. There is no network request, no analytics event carrying the field value, no local storage and no history. The page holds the string in memory only while it is on screen, and reloading or closing the tab discards it.