Password Strength Checker
Test how strong a password is and see roughly how long it would take an attacker to crack it. Free, instant and private — your password is analysed right in your browser and never sent anywhere.
Your password is checked entirely on your device. It is never uploaded, stored or logged.
Checklist
- At least 12 characters
- Contains lowercase letters (a–z)
- Contains uppercase letters (A–Z)
- Contains numbers (0–9)
- Contains symbols (!@#$…)
- Not a common or predictable password
How to use the password strength checker
- Type or paste a password. Enter the password you want to evaluate in the box above. Use the Show button if you want to see what you typed.
- Read the strength meter. The coloured bar, rating and entropy score update instantly, showing how resistant the password is to guessing.
- Fix the weak points. Follow the checklist and tips to add length and variety, then re-test until the estimated crack time reaches centuries.
About this tool
This free password strength checker estimates how hard a password is to guess by measuring its entropy — the number of bits of randomness it contains. Entropy is calculated from the size of the character set you used (lowercase, uppercase, digits and symbols) and the length of the password, then adjusted downward for common passwords and predictable patterns such as repeated characters or simple sequences. A higher entropy means exponentially more guesses are needed to break it.
The estimated crack time assumes a fast offline attack of about 10 billion guesses per second, roughly what a modern GPU rig can achieve against a weak password hash. Because everything runs locally in your browser, your password is never transmitted or saved anywhere — making this a safe way to audit the passwords you already use before storing them in a password manager.
Frequently asked questions
Is it safe to type my real password here?
Yes. The entire analysis happens with JavaScript in your browser — nothing you type is sent over the network, logged, or stored. You can disconnect from the internet and the tool still works. That said, avoid entering passwords into any site you do not trust.
What does the entropy score mean?
Entropy, measured in bits, is the base-2 logarithm of the number of possible passwords of the same length and character set. Each extra bit doubles the number of guesses an attacker needs. Under 28 bits is very weak, 60+ bits is strong, and 128+ bits is considered very strong.
How accurate is the "time to crack" estimate?
It is a guideline, not a guarantee. Real crack time depends on the hashing algorithm, the attacker's hardware and whether the password appears in a breach list. We assume 10 billion guesses per second, so treat the figure as a worst-case ballpark for a determined attacker.
How can I make a strong password?
Length matters most: aim for at least 12–16 characters. Mix upper and lower case, numbers and symbols, and avoid dictionary words, names, dates and keyboard patterns. A random passphrase of four or more unrelated words, or a password generated by a password manager, is ideal.