Password Strength Checker
Test how strong a password really is — entropy in bits, an offline crack-time estimate and a checklist of exactly what to fix.
Your password stays in this browser tab. It is never uploaded, logged or stored.
Enter a password 0 bits Cracked in —
Offline attack estimate at 10 billion guesses per second.
Checklist
- At least 12 characters not met
- Contains a lowercase letter not met
- Contains an uppercase letter not met
- Contains a number not met
- Contains a symbol not met
- Not a common or leaked password not met
- No repeated or sequential runs (aaa, 123, abc) not met
How to make it stronger
How it works
Type a password and the checker scores it as you type. It measures how much real
randomness the password carries (its entropy, in bits), then estimates how long an
offline attacker with fast hardware — around 10 billion guesses per second — would
need to guess it. Characters that simply repeat the previous one or continue a run
like abc or 123 only add about one bit each instead of a
full character's worth, and passwords built on a common or leaked base word are
capped hard, which is why Password123! scores far worse than its length
suggests.
The checklist shows exactly what is missing and the suggestions tell you what to fix.
Everything runs in your browser with plain JavaScript: there is no network request, no
analytics on what you type, and the downloadable report deliberately never contains the
password itself — only its length, character types and score. Need a new one? The
generator uses crypto.getRandomValues for cryptographically secure
randomness and guarantees a mix of upper case, lower case, numbers and symbols.
Frequently asked questions
How strong is my password?
Type it in and the checker scores it live. It works out how much genuine randomness the password carries (its entropy, in bits), then rates it from Very weak to Very strong: under 28 bits is trivially guessable, 60–80 bits is decent, and 80 bits or more is very strong. The checklist below the meter shows precisely which ingredients are missing — length, mixed case, numbers, symbols, no common base word and no repeated or sequential runs.
How long would it take to crack my password?
The crack-time estimate assumes an offline attacker who has stolen the password database and can try about 10 billion guesses per second on consumer GPUs, needing on average half the key space. That is a deliberately pessimistic scenario: a well-throttled online login is millions of times slower. If the tool says minutes or days, treat the password as already broken; anything reading centuries is comfortably out of reach.
Is it safe to type my password into an online strength checker?
With most of them, no — many send the password to a server or load third-party ad and analytics scripts that can see what you type. This one is different: every calculation runs in your browser in plain JavaScript, there is no network request of any kind, nothing is logged or stored, and the downloadable report intentionally contains only the length, character types and score, never the password itself. You can disconnect from the internet and it still works.