Password Strength Checker
- At least 8 characters
- Uppercase letter (A-Z)
- Lowercase letter (a-z)
- Number (0-9)
- Symbol (!@#...)
What is Password Strength Checker
A password strength checker analyzes a password with the same math used in real cracking attacks, not just a minimum-length rule. It calculates the entropy in bits, estimates how long a machine built for cracking passwords would take to guess it, and flags risky patterns such as repeated characters, keyboard rows, or passwords already found in known leaks. Everything runs locally in your browser, so the password you type is never sent anywhere.
How to use
- Type or paste the password you want to test into the field.
- Click the eye icon if you need to see the characters to check for typos.
- Read the strength bar, the entropy in bits, and the estimated crack time.
- Fix any warning shown below, such as a repeated pattern or a common leaked password, and check again until it reads Strong or Very strong.
When to use it
Not sure if the password you just picked is actually safe? Type "Tr0ub4dor&3" and you will see it score lower than expected once patterns are factored in, while a random 16-character mix like "xK7!qT9#zM2@wR5$" lands in the very strong range in seconds. Use it before locking in the password for your email, your bank, or the master password of your password manager, especially one you were planning to reuse as a memorable phrase.
Frequently asked questions
Is my password sent to a server when I check it here?
No. All analysis happens locally in your browser using JavaScript. The password never leaves your device and is never logged anywhere.
What does entropy in bits actually mean?
Entropy measures how unpredictable a password is. Each extra bit doubles the number of guesses an attacker needs, so a password with 60 bits of entropy takes about a billion times longer to guess than one with 30 bits.
Why did a long password still score as weak?
Length alone is not enough. If the password uses a dictionary word, a keyboard row like "qwerty", or a repeated pattern like "aaaa", it becomes far easier to guess than its length suggests, so the score drops accordingly.
What crack-time assumption does this tool use?
The estimate assumes an offline attacker running 10 billion guesses per second, a realistic figure for cracking a stolen password hash with current GPU hardware. Real-world time can vary with the exact hashing method a service uses.
Related tools
AES Text Decryption
Decrypt AES-256 encrypted text with your password in your browser. Free, private, and fully offline. No data leaves your device.
AES Text Encryption
Encrypt text with a password using AES-256 in your browser. Free, private, and fully offline. Nothing is sent to a server.
Aspect Ratio Calculator
Calculate aspect ratios, find a missing width or height, and resize images or video while keeping the same proportions. Free and instant.