Wondering whether your password would actually hold up against an attacker? Type or paste it into the checker to see its estimated strength in real time — its entropy in bits, roughly how long it would take to crack, and a checklist of what is strong and what to improve. Everything is analysed locally in your browser using JavaScript, so your password is never sent, logged, or stored anywhere.

How password strength is measured

Strength comes down to one question: how many guesses would an attacker need before they hit yours? The more unpredictable your password, the more guesses are required. This is measured in entropy, expressed in bits — and every extra bit doubles the number of possibilities. A password with 40 bits of entropy can be broken quickly by modern hardware; one with 80 bits or more is comfortably out of reach for brute force today.

Our checker estimates entropy from two things: how long the password is, and how large its character pool is (lowercase, uppercase, numbers, and symbols each enlarge the pool). It then lowers that estimate when it spots predictable patterns — a common password, a keyboard run like qwerty, a sequence like 1234, or the same character repeated — because attackers try those first. The crack-time figure assumes a fast offline attack of about a trillion guesses per second, a deliberately pessimistic scenario, so a password rated "Very strong" here has a healthy margin in the real world.

What makes a password weak

Most compromised passwords share the same handful of flaws. The checker flags each of them:

• Too short. Length matters more than anything else. A short password — even a random one — simply has too few combinations.
• Common passwords. Words like password, 123456, and qwerty appear on every attacker's list and fall instantly.
• Predictable patterns. Keyboard runs (asdf), number sequences (1234), and repeated characters (aaaa) add length without adding real unpredictability.
• One character type. All-lowercase or all-numbers passwords keep the character pool small and the entropy low.
• Personal information. Names, birthdays, and pet names are easy to guess or find online, so avoid them even though a checker cannot detect them.

What makes a password strong

• Length first. Aim for at least 12 characters, and 16 or more for important accounts. Longer always beats shorter.
• A mix of character types. Combining uppercase, lowercase, numbers, and symbols enlarges the pool and raises entropy.
• Randomness, not patterns. The strongest passwords have no words, no sequences, and no structure an attacker can predict.
• Uniqueness. Even a strong password is risky if you reuse it — one breached site then exposes every account that shares it.

The easiest way to meet all four at once is to let a generator do it for you. Create one now with our free password generator, then paste it back here to confirm its strength.

How to read the results

As you type, the meter moves from Weak to Very strong, and the requirements list ticks off each property your password has: length, uppercase, lowercase, numbers, symbols, and the absence of common words or patterns. The feedback line points you to the single most important thing to fix. Aim to fill every requirement and reach "Very strong" before you trust a password with an important account.

Is it safe to type my password here?

Yes. The checker runs entirely in your browser — there is no server involved in the analysis. What you type is never transmitted over the network, never written to a log, and never stored; it disappears the moment you close or reload the page. You can even disconnect from the internet and the checker keeps working. To learn what limited, anonymous data the website itself collects, see our Privacy Policy. As a general habit, only ever enter your real passwords on tools you trust and that, like this one, do all the work locally.

Frequently asked questions

Does this send my password anywhere?

No. All analysis happens in your browser with JavaScript. Your password is never sent, logged, or stored, and it is gone as soon as you leave the page.

How accurate is the strength estimate?

It is a solid, transparent estimate based on length, character variety, and common-pattern detection — the same factors that matter most in real attacks. No checker can be perfect (it cannot know, for example, that a password is your dog's name), so treat the result as strong guidance rather than a guarantee.

What is a good entropy or crack time?

Above about 80 bits of entropy is hard to brute-force with today's hardware, and 100+ bits leaves a wide safety margin. If the estimated crack time is measured in centuries or longer, you are in good shape.

My password got a low score even though it feels complex. Why?

Complexity that follows a pattern is not as strong as it looks. Substitutions like P@ssw0rd, keyboard runs, and short length all pull the score down because attackers expect them. Length and genuine randomness raise it the most.

What should I do with a weak password?

Replace it. Generate a long, random one with our password generator, store it in a password manager, and enable two-factor authentication on the account for an extra layer of protection.