Password Strength Checker

Enter a password and see how it holds up: an entropy estimate, an approximate time to crack under realistic offline attack conditions, and the specific weaknesses that reduce its strength.

The analysis is local. The password is never sent anywhere, which is the only condition under which typing a real password into a web page is defensible.

Free · runs in your browser · updated

Enter Password

This check runs 100% locally. Your password is never sent anywhere.

Analysis
Start typing to see analysis...

Password Strength Checker at a glance

What it does
Analyse password strength and see an estimated time to crack, entirely in your browser. Nothing is transmitted, logged or checked against any list online.
Where it runs
Entirely in your browser — no data is uploaded
Works offline
Yes, once the page has loaded
Cost
Free, with no account and no usage limit

How to use the checker

  1. Type a password. Analysis updates as you type.
  2. Read the score and the estimated crack time.
  3. Read the specific weaknesses - a dictionary word, a keyboard pattern, a predictable substitution.
  4. Adjust and watch the estimate move. Adding length usually helps far more than adding a symbol.

As a general habit, do not type real passwords into websites. This page analyses locally and transmits nothing, but you cannot verify that from the outside for any site. If in doubt, test a password of the same structure rather than the real one.

What entropy actually measures

Entropy, measured in bits, is the base-two logarithm of the number of possibilities an attacker must search. Each additional bit doubles the work. Around 60 bits is adequate for most accounts; 80 or more is strong.

The subtlety is that entropy belongs to the process that generated the password, not to the string. Tr0ub4dor&3 looks complex and is weak, because it follows a predictable recipe - a dictionary word with obvious substitutions and a symbol appended - that cracking software models explicitly. correct horse battery staple looks simple and is strong, because four words drawn randomly from a large list genuinely require searching that space.

Attack tools do not brute-force character by character. They try leaked passwords first, then dictionary words with mangling rules, then patterns. A password is only as strong as the most efficient rule that produces it.

Reading the crack time estimate

Any such figure depends on assumptions, and it is worth knowing which.

ScenarioRateEffect
Online attack, rate limitedUnder 100 guesses/secondEven a modest password survives, provided the site limits attempts.
Offline, database of bcrypt hashesTens of thousands/secondA slow hash buys enormous protection.
Offline, database of unsalted SHA-256Tens of billions/second on one GPUAnything under twelve random characters is at risk.
Password appears in a breach listInstantLength and complexity are irrelevant. It is already known.

The last row is the one that matters most. A password that has appeared in any public breach is compromised regardless of how strong it looks, because attackers try known passwords before anything else.

Patterns that cost you more than you think

  • A word with substitutions. P@ssw0rd is in every cracking rule set. Leetspeak adds almost nothing.
  • A capital at the start and a digit at the end. The single most common structure, and the first thing tried.
  • Keyboard walks. qwerty, 1qaz2wsx, zxcvbnm are enumerated directly.
  • Dates. Birth years and anniversaries reduce a four-digit component to a few dozen realistic options.
  • Personal information. Names of family, pets and employers are in targeted wordlists.
  • Site name in the password. Facebook2024! is guessed immediately once the pattern is known from another breach.

What actually protects an account

Password strength is one factor among several, and not the most important one.

Uniqueness beats strength. A strong password reused across ten sites fails completely when any one of them is breached. Credential stuffing - replaying leaked pairs against other services - is how most account takeovers happen, and no amount of complexity prevents it.

Two-factor authentication beats both. An authenticator app or a hardware key stops an attacker who has your password outright. Enable it on email first, then on financial accounts, then everywhere it is offered. SMS is the weakest form because of SIM swapping, but it is still far better than nothing.

Passkeys remove the problem. Where a site supports them, they replace the password with a device-held key that cannot be phished or reused.

Frequently asked questions

The analysis runs entirely in your browser and nothing is transmitted. That said, the safe habit is never to enter real passwords on any website - test a similar password with the same structure instead.

Because complexity is not the same as unpredictability. A dictionary word with substitutions and a trailing digit follows a pattern that cracking software generates directly, so it is found far faster than its character count suggests.

No - that would require sending data to an external service. Check separately at Have I Been Pwned, which uses a privacy-preserving method that never reveals your full password.

They are order-of-magnitude guides that depend heavily on how the site stored your password. Treat "centuries" as safe and anything measured in hours or days as needing replacement; the precise number is not meaningful.

Long, random, unique to one site, generated by software and stored in a password manager - combined with two-factor authentication. The password is only part of the defence.

Nothing you enter here leaves your browser

Password Strength Checker does its work in JavaScript running on your own device. The page loads once, and after that there is no upload step and no server involved — which matters here because a generated password or key is worthless the moment a third party has a copy of it.

You can verify this rather than taking our word for it: load the page, disconnect from the internet, and the tool keeps working. Our privacy policy sets out what is and is not collected, and this guide explains why the distinction matters.