Password Strength Checker
Test password strength with entropy scoring, common-pattern detection, and estimated crack time. Your password never leaves your browser.
About Password Strength Checker
A strong password is the difference between an account you own and an account that will be brute-forced next month. This password strength checker analyzes any password you enter and produces a strength score (0-100), an entropy calculation in bits, a bracket rating (very weak to excellent), and an estimated crack time based on modern GPU-assisted attack speeds. It runs entirely in your browser — the password never leaves your device, verifiable by opening the network tab and seeing zero outbound traffic while you type.
The checklist breaks down exactly what makes the password strong or weak: length, character diversity (lowercase, uppercase, digits, symbols), presence in common-password dictionaries, keyboard-pattern detection (qwerty, asdf), sequential characters (1234, abcd), and repeated characters (aaa, 111). This is more useful than a single-number score — it tells you why the password is weak and what to change. Ideal for testing new passwords before saving them to a password manager, auditing password policies in your organization, or teaching password hygiene without exposing real passwords to a third-party tool.
How to Use
Type or paste a password into the input field.
The strength meter updates instantly — score, bracket, and estimated crack time.
Read the checklist below to see exactly which properties your password has and which it is missing.
Use the results to decide whether the password is strong enough for the account it protects — bank/email accounts should score at least 80.
Frequently Asked Questions
Is my password sent to your server when I test it?
No. The entire strength analysis runs in your browser via JavaScript. Open your browser's Network tab while you type — you will see zero outbound requests. Test freely, even with real passwords you use for real accounts.
How is the crack time estimated?
The estimate is based on entropy (log2 of the possible character space raised to the length) divided by a rough offline-attack speed of 10 billion guesses per second — the ballpark for modern GPU-accelerated cracking of a bcrypt hash. This is a rough guide, not a security guarantee. Real crack time depends on the attacker's hardware and the hashing algorithm used to store your password.
What score should my password have?
80 or higher for anything sensitive (email, banking, admin accounts). 60-79 is acceptable for lower-risk services with 2FA also enabled. Below 60 is easily brute-forced by a determined attacker with modest hardware.
Why does adding a symbol boost the score so much?
Each additional character class (lowercase, uppercase, digit, symbol) roughly doubles the possible character space per position. A 10-character password with lowercase only has 26^10 possibilities; adding symbols brings it to 93^10 — about 10 million times more combinations to try.
Is a longer weak password better than a shorter strong one?
Usually yes. Length beats complexity: a 20-character passphrase like 'correct-horse-battery-staple' scores extremely high (~5 * 10^36 possibilities) despite being all lowercase, because length is exponential. But shorter passwords need character diversity to compensate. Aim for 16+ characters with mixed classes for the best of both.