Password Strength Checker
Find out how strong a password actually is — entropy, specific weaknesses, estimated crack time, and an optional policy checklist. Nothing you type here ever leaves your browser.
Choose at least one character type.
{{ g.value }}
{{ g.strength.label }}
{{ strength.label }} — {{ strength.entropyBits }} bits of entropy
- {{ f }}
Estimated time to crack
A mathematical estimate assuming pure random guessing against this exact password — it cannot detect a password reused elsewhere, or one guessable from your name, birthday, or other personal information.
Nothing is sent anywhere — this runs entirely in your browser.
Check against a specific password policy
- {{ c.label }}
The password you check is scored entirely in your browser and is never transmitted, logged, or stored anywhere — not even in an analytics event.
Why entropy matters more than complexity rules
A rule like "must contain a symbol" only adds a little unpredictability, and most people satisfy it the same predictable ways every time — a trailing "!" or swapping "a" for "@". Entropy measures the actual size of the search space an attacker would have to try, and length grows that space far faster than any single character-class requirement does.
What this checker actually looks for
Beyond a raw entropy calculation, the score is capped low for passwords that are long but
still predictable: common passwords (including with letter/number substitutions like
P@ssw0rd), sequential runs like abcd or 1234, and
keyboard-adjacency patterns like qwerty or asdfgh.
Crack-time estimates are a range, not a guarantee
The estimated time shown assumes pure random guessing against this exact password, across a few disclosed attacker speeds. It cannot detect a password reused on another site, or one guessable from your name, birthday, or other personal information — no local calculation can, since that requires knowing something about you rather than the password itself.
Need a strong password instead of checking one?
Use the Password Generator — random, pronounceable, or PIN, with full control over length and character classes.
Frequently asked questions
Is my password sent anywhere when I check it?
No. Scoring runs entirely in your browser with JavaScript. Nothing is transmitted to a server, logged, or included in any analytics event — that is the entire point of a local strength checker.
Why does entropy matter more than complexity rules?
A rule like "must contain a symbol" only adds a little unpredictability, and people satisfy it the same predictable ways every time (a trailing "!" or swapping "a" for "@"). A longer password draws from a much bigger space of possibilities, which is what actually slows down a guessing attack — length beats forced complexity almost every time.
What is a crack-time estimate, and how accurate is it?
It is a mathematical estimate of how long brute-forcing this exact password would take, shown across a few different attacker speeds. Treat it as a rough order of magnitude, not a guarantee — it assumes pure random guessing and cannot model a targeted attacker using your name, birthday, or a password you have reused elsewhere.
Why did a long password still score as weak?
Length alone is not enough if the content is predictable — "aaaaaaaaaaaa", "abcdefghijkl" and "qwertyuiopasdfgh" are all long but instantly guessable, so they are capped at a weak score regardless of what a pure entropy formula would say.
What is the policy checklist for?
For matching a specific requirement — a workplace or client's password rules — rather than this tool's general opinion of strength. Set the minimum length and required character classes, and it shows exactly which rules a password does or does not satisfy.
Should I use a password manager instead?
Yes, for anything you need to remember across sites. A password manager lets every account have a long, unique, random password without you memorizing any of them — this checker is for understanding what makes a password strong, not a substitute for one.