Password strength checker

A password strength test that stays on your device

This password strength checker rates a password while you type it. It does not just count capitals and symbols. It looks for what cracking software tries first: the most used passwords, dictionary words, keyboard runs such as qwerty, repeated characters, dates and letters swapped for look-alike digits. From that it works out how many guesses an attacker would need, a rating on five levels and three times to crack.

Everything runs in your browser. The password is never sent or stored, and the tool makes no network request while it checks. It does not look your password up in breach databases either: some services offer that check by sending only an anonymised fragment of the password's hash, but we chose to send nothing at all.

How to use it

1. Type or paste your password into "Password to test". It stays hidden; "Show" reveals it and "Clear" empties the field. While it is hidden, weaknesses refer to positions ("Characters 1 to 6") instead of quoting your text.
2. Read the "Strength": Very weak, Weak, Fair, Strong or Very strong, with a five-step meter.
3. Check the "Estimated time to crack" in the three scenarios, then the "Weaknesses found" and the "Tips".

What makes a password strong

Two things matter: length and unpredictability. Each extra character multiplies the attacker's work, as long as it does not follow a known pattern. Complexity rules alone are misleading. Summer2024! ticks every box: capital, lowercase, digits and a symbol. Ignoring patterns it would be worth 72 bits. The checker sees a common password, a recent year and a capital first letter: about 100,400 guesses, 17 bits, roughly a month against a throttled login and 10 seconds against a slow hash.

Passphrases, password managers and two-factor authentication

A passphrase strings together several randomly chosen words. Five words picked from a list of 1,296 give about 5.8 × 10¹⁶ guesses, more than 185,000 years against a slow hash, and they are far easier to remember than a jumble of symbols. The words must be drawn at random, not taken from a song lyric or a saying.

Use a different password for every account. When one site loses its database, attackers try the same email and password everywhere else. A password manager creates and remembers unique passwords for you, so you only need one strong passphrase. Turn on two-factor authentication for email, banking and social media.

If a service you use is breached, change that password straight away, plus any similar ones, sign out of open sessions and be wary of emails claiming to come from that service.

How the checker estimates strength, and its limits

The checker looks for the cheapest way to split your password into known patterns. A common password counts as its rank in the list; an English dictionary word as the size of the list; a date as the number of plausible years times 365; a keyboard run by its possible starting keys and turns. Characters outside any pattern count as 10 options each, a cautious assumption. Multiplying the parts gives the number of guesses and the adjusted entropy.

The thresholds: under 1,000 guesses is very weak, under 100 million weak, under 10¹³ fair, under 10¹⁸ strong, above that very strong. Times assume 100 guesses per hour online, 10,000 per second against a slow hash and 10 billion per second against a fast hash. They are orders of magnitude: an estimate, not a guarantee. The tool cannot know what an attacker knows about you (a child's name, your street) and only holds a few thousand words.

Frequently asked questions

Is my password sent anywhere?

No. The analysis runs inside the page, the tool sends no request while you type and nothing is kept in your browser.

Why is "Tr0ub4dor&3" only fair?

At 11 characters it is short: about 10¹¹ guesses, which a fast offline attack gets through in about 10 seconds.

Do I need symbols for a strong password?

They help a little, but length matters far more. Five random lowercase words beat eight characters packed with symbols.

Is a "Very strong" password uncrackable?

No. It resists guessing, but not phishing, spyware or reuse on a hacked site. That is why you need one password per account and two-factor authentication.