About this password strength checker
A password strength checker tells you, in seconds, whether your password can stand up to a brute-force attack. This one scores your password with real entropy math, shows an estimated crack time, and gives concrete fix tips — free, with no sign-up required.
The tool is for anyone creating or reviewing passwords: new accounts, password resets, company password policies, or just checking the password you have used for years. You enter a candidate password, and the tool analyzes its length and character variety, then outputs a strength bar, a plain-English verdict, and an estimated crack time assuming an attacker making 10 billion guesses per second. Weak spots — short length, missing character classes, predictable patterns — come with tips to fix them.
Everything runs entirely in your browser. Your password is never sent to a server, stored, or logged — it never leaves your device, so it is safe to test real passwords here.
How to use it
- Type or paste your password into the "Enter your password" field.
- Click "Check strength".
- Read the strength bar and verdict next to the "Estimated crack time", then apply the fix tips to any weak spots.
The method behind it
Frequently asked questions
Is it safe to enter my real password in this checker?
Yes. The entire check runs in your browser — your password is never sent to a server, never stored, never logged, and never leaves your device. Nothing is transmitted over the network at all, so testing a real password here is safe.
What counts as a strong password?
Aim for at least 80 bits of entropy — for example, 12 or more fully random characters mixing all four classes, or a long multi-word passphrase. The tool's verdict is based on entropy: higher bits mean exponentially harder brute force, so length is the single biggest lever you control.
What does "estimated crack time" actually mean?
It estimates how long pure brute force would take if an attacker tried 10 billion guesses per second against your password's full entropy. Real attackers also use smarter methods — dictionary attacks, credential leaks, phishing — so treat the number as a best-case upper bound for the password itself, not a security guarantee.
Is a long passphrase better than a short complex password?
Usually, yes. Entropy grows with every character, so a 20-character passphrase of ordinary words typically beats an 8-character mix of symbols. Passphrases are also easier to remember and type. Either way, run it through the checker to confirm the actual bit count.
Worked example
Take a 16-character password that uses all four character classes: lowercase, uppercase, digits, and symbols. The pool size is N = 94. log₂(94) ≈ 6.5546, so each character carries about 6.55 bits of entropy. Total entropy = 16 × 6.5546 ≈ 104.87 bits, displayed as ~105 bits.
The guess space is 2^104.87 ≈ 3.7 × 10³¹ possibilities. At 10 billion (10¹⁰) guesses per second, that is 3.7 × 10³¹ / 10¹⁰ ≈ 3.7 × 10²¹ seconds — about 1.2 × 10¹⁴ years, far longer than the age of the universe.