The Password Strength Checker tells you how strong a password really is. Type or paste a password and it instantly rates it, estimates how long it would take an attacker to crack, measures its strength in bits of entropy, and points out exactly what’s making it weak — repeated characters, common words, keyboard patterns, sequences, and more.
Everything runs locally in your browser. Your password is never sent to a server, stored, or logged — the analysis happens entirely on your device, so it stays private to you.
How to check your password strength
- Type or paste the password you want to test into the box. Use the eye icon to show or hide it.
- Read the strength rating and the estimated time to crack — this updates live as you type.
- Review the “Weaknesses found” list for any patterns an attacker could exploit.
- Use the checklist to see which best practices your password meets, and adjust it until it rates Strong or Very strong.
How password strength is measured
Strength is measured in bits of entropy — a number that reflects how many guesses an attacker would need to find your password by brute force. Every extra character and every additional character type (uppercase, lowercase, numbers, symbols) multiplies the number of possibilities, which raises the entropy.
This checker also looks for predictable patterns — common leaked passwords, keyboard runs like “qwerty”, sequences like “abc” or “123”, repeated characters, and years. Those patterns make a password far easier to guess than its length suggests, so the tool lowers the effective strength and the estimated crack time accordingly.
What makes a password strong
- Length first — aim for at least 12–16 characters. Length beats complexity.
- Mix character types: uppercase, lowercase, numbers, and symbols.
- Avoid dictionary words, names, dates, and keyboard patterns.
- Never reuse a password across accounts, and avoid ones from known breaches.
- A random passphrase of several unrelated words is both strong and easier to remember.
Frequently Asked Questions
Is it safe to type my real password here?
The checking happens entirely in your browser — nothing is uploaded, stored, or logged. That said, as a general habit you should never type a password you actively use into any website. To test the kind of password you use, try a similar one with the same length and character mix.
How is the “time to crack” estimated?
It assumes a fast offline attack of about 10 billion guesses per second against a leaked password hash, and calculates how long it would take to search roughly half the possible combinations. Real-world speeds vary, so treat the figure as a guide, not a guarantee.
What does “entropy in bits” mean?
Entropy measures unpredictability. Each extra bit doubles the number of guesses needed. As a rough guide, under 28 bits is very weak, 60 bits is decent, and 80 bits or more is strong enough to resist brute-force attacks with today’s hardware.
Why is my long password still rated weak?
Length helps only when the characters are unpredictable. If your password is a common word, a keyboard pattern, a sequence, or mostly repeated characters, an attacker can guess it far faster than a brute-force search — so the checker rates it down and lists the pattern under “Weaknesses found”.
Does this store or remember my password?
No. There is no server involved and nothing is saved. When you close or refresh the page, whatever you typed is gone.