Password Strength Checker
Type a password to see a rough strength rating, estimated entropy and an offline guessing time band. The checker looks for the patterns attackers try first: common passwords, sequences like 1234, repeated characters, keyboard runs like qwerty, and years or dates. Everything runs in your browser and nothing you type leaves your device.
Password Strength Checker
Everything runs in your browser. Nothing you type leaves your device or is stored. Even so, prefer testing a password that is similar to yours rather than the real one.
Suggestions
The guessing time is a rough band assuming an attacker with a stolen, weakly hashed password database trying about ten billion guesses a second. Slow hashes such as bcrypt or Argon2 make guessing far slower; online login forms with rate limits slower still. Real attackers use smarter word lists than any checker can model, so treat this as guidance, not a guarantee.
Runs in your browser. Nothing you enter is uploaded or saved.
How to use this tool
- Type a password. Enter a password or passphrase. Use Show to check what you typed.
- Read the rating. Check the strength label, estimated entropy and rough guessing time.
- Fix the weak spots. Follow the suggestions, such as removing dates or sequences or making it longer.
- Store it safely. Save the final password in a password manager and turn on two-factor authentication.
Length beats complexity
Each extra character multiplies the number of guesses needed. A passphrase of four or five random, unrelated words is usually both longer and easier to remember than a short jumble of symbols. Current NIST guidance favours length and screening against known-breached passwords over forced complexity rules.
What entropy means here
Entropy (in bits) estimates how many guesses an attacker would need: each extra bit doubles it. This tool starts from length and character variety, then reduces the score for predictable patterns. It is an estimate; real attackers use large breach lists and clever rules.
Use a password manager
The biggest risk is reusing one password across sites: when one site leaks it, attackers try it everywhere. A password manager creates and remembers a unique password for every account, and two-factor authentication protects you if one leaks.
Frequently asked questions
Is it safe to type my real password here?
The check runs only in your browser and nothing is sent or stored. Even so, it is good practice to test a similar password rather than one you use.
How long should a password be?
Aim for at least 12–16 characters for important accounts, or four or more random words for a passphrase. Longer is better when a password manager remembers it for you.
Why is P@ssw0rd rated weak?
Swapping letters for look-alike symbols is a well-known trick, and attackers’ tools try those substitutions automatically.
How accurate is the guessing time?
It is a rough band based on a fast offline attack. Real times depend on how the site stores passwords and the attacker’s methods.