Password Strength Checker at a glance
- What it does
- Analyse password strength and see an estimated time to crack, entirely in your browser. Nothing is transmitted, logged or checked against any list online.
- Where it runs
- Entirely in your browser — no data is uploaded
- Works offline
- Yes, once the page has loaded
- Cost
- Free, with no account and no usage limit
- Category
- Generators & Security
How to use the checker
- Type a password. Analysis updates as you type.
- Read the score and the estimated crack time.
- Read the specific weaknesses - a dictionary word, a keyboard pattern, a predictable substitution.
- Adjust and watch the estimate move. Adding length usually helps far more than adding a symbol.
As a general habit, do not type real passwords into websites. This page analyses locally and transmits nothing, but you cannot verify that from the outside for any site. If in doubt, test a password of the same structure rather than the real one.
What entropy actually measures
Entropy, measured in bits, is the base-two logarithm of the number of possibilities an attacker must search. Each additional bit doubles the work. Around 60 bits is adequate for most accounts; 80 or more is strong.
The subtlety is that entropy belongs to the process that generated the password, not to the string. Tr0ub4dor&3 looks complex and is weak, because it follows a predictable recipe - a dictionary word with obvious substitutions and a symbol appended - that cracking software models explicitly. correct horse battery staple looks simple and is strong, because four words drawn randomly from a large list genuinely require searching that space.
Attack tools do not brute-force character by character. They try leaked passwords first, then dictionary words with mangling rules, then patterns. A password is only as strong as the most efficient rule that produces it.
Reading the crack time estimate
Any such figure depends on assumptions, and it is worth knowing which.
| Scenario | Rate | Effect |
|---|---|---|
| Online attack, rate limited | Under 100 guesses/second | Even a modest password survives, provided the site limits attempts. |
| Offline, database of bcrypt hashes | Tens of thousands/second | A slow hash buys enormous protection. |
| Offline, database of unsalted SHA-256 | Tens of billions/second on one GPU | Anything under twelve random characters is at risk. |
| Password appears in a breach list | Instant | Length and complexity are irrelevant. It is already known. |
The last row is the one that matters most. A password that has appeared in any public breach is compromised regardless of how strong it looks, because attackers try known passwords before anything else.
Patterns that cost you more than you think
- A word with substitutions.
P@ssw0rdis in every cracking rule set. Leetspeak adds almost nothing. - A capital at the start and a digit at the end. The single most common structure, and the first thing tried.
- Keyboard walks.
qwerty,1qaz2wsx,zxcvbnmare enumerated directly. - Dates. Birth years and anniversaries reduce a four-digit component to a few dozen realistic options.
- Personal information. Names of family, pets and employers are in targeted wordlists.
- Site name in the password.
Facebook2024!is guessed immediately once the pattern is known from another breach.
What actually protects an account
Password strength is one factor among several, and not the most important one.
Uniqueness beats strength. A strong password reused across ten sites fails completely when any one of them is breached. Credential stuffing - replaying leaked pairs against other services - is how most account takeovers happen, and no amount of complexity prevents it.
Two-factor authentication beats both. An authenticator app or a hardware key stops an attacker who has your password outright. Enable it on email first, then on financial accounts, then everywhere it is offered. SMS is the weakest form because of SIM swapping, but it is still far better than nothing.
Passkeys remove the problem. Where a site supports them, they replace the password with a device-held key that cannot be phished or reused.
Frequently asked questions
The analysis runs entirely in your browser and nothing is transmitted. That said, the safe habit is never to enter real passwords on any website - test a similar password with the same structure instead.
Because complexity is not the same as unpredictability. A dictionary word with substitutions and a trailing digit follows a pattern that cracking software generates directly, so it is found far faster than its character count suggests.
No - that would require sending data to an external service. Check separately at Have I Been Pwned, which uses a privacy-preserving method that never reveals your full password.
They are order-of-magnitude guides that depend heavily on how the site stored your password. Treat "centuries" as safe and anything measured in hours or days as needing replacement; the precise number is not meaningful.
Long, random, unique to one site, generated by software and stored in a password manager - combined with two-factor authentication. The password is only part of the defence.
Nothing you enter here leaves your browser
Password Strength Checker does its work in JavaScript running on your own device. The page loads once, and after that there is no upload step and no server involved — which matters here because a generated password or key is worthless the moment a third party has a copy of it.
You can verify this rather than taking our word for it: load the page, disconnect from the internet, and the tool keeps working. Our privacy policy sets out what is and is not collected, and this guide explains why the distinction matters.