Free tool
Password strength checker
See how long a password would hold up against guessing, and why. It's checked in this tab and never sent anywhere.
Check a password
What you type stays in this tab. It's never sent or saved.
It never leaves this page, but the safest habit is not to type a live password into any website. Try one built the same way.
Type a password to see what an attacker would try first.
Where the bits come from
Each piece of the password is priced the way an attacker would guess it: words and years from a list, runs and repeats almost free, random characters at full price.
How it scores
Priced the way an attacker guesses
- Start from the characters
- Lowercase alone gives 26 options per character; add capitals, digits and symbols and it's about 95. That sets the price of a truly random character.
- Charge less for patterns
- Common passwords and words, years, repeated characters, runs like abc or 123, and keys next to each other cost an attacker very few guesses.
- Take the cheapest reading
- The checker splits the password the way that makes it easiest to guess, and adds up the pieces. That's the number you see.
- Turn bits into time
- Half the guesses, at two speeds: a GPU rig against a leaked fast hash, and a login that doesn't slow down wrong attempts.
Example
Why P@ssw0rd2024! is weak
It's 13 characters with every character type, which a rule-based meter would call strong. An attacker sees three pieces: P@ssw0rd, one of the most common passwords there is, with the two swaps everyone makes; 2024, a recent year; and !, the symbol people tack on most. Guessing tools try exactly those combinations first. Priced that way it comes to about 24 bits, which a fast offline attack gets through in well under a second.
Compare a random 13-character password from the same character set: about 85 bits, out of reach of any known guessing attack. The length and character types are the same. The difference is that nobody chose the characters.
Limits
What the estimate can't see
- Its list of common passwords and words is short, so it runs instantly in the page. Real attackers use lists with billions of entries.
- It doesn't know you. A name, a street or a team that means something to you is easy for someone who does.
- It can't tell whether a password has already leaked. The breached password checker can, without sending the password.
- Passwords from the password generator don't need guessing: it knows how they were made and shows their exact entropy.
Fixing it
How to make a weak password strong
Don't edit it. Adding a digit or swapping a letter for a symbol is exactly what guessing tools expect. Replace it with something random: a password generator for logins you never type by hand, and a passphrase of random words for the few you do, like a laptop or a password manager. Then use each password in one place only. Most accounts are broken with passwords that leaked somewhere else, and no amount of strength helps a password that's already on a list.
If you have to send a new password to someone, don't paste it into chat or email where it stays. A secure note is encrypted in your browser and can delete itself after one read.
Privacy
Why nothing is sent
Some strength meters send what you type to a server to score it, and you can't see what that server keeps. This one is a short piece of JavaScript running in your tab: no request, no storage, no history. Once the page has loaded it works with the network off. The code is open source under the MIT license.
FAQ
Questions
Is it safe to type my password here?
It never leaves the tab: the check is JavaScript running on your device, and it makes no network request. Even so, the safest habit is not to type a password you use today into any website. Type one built the same way and you'll learn just as much.
How is password strength measured?
In bits of entropy, a count of how many guesses an attacker would need. Each bit doubles the work. The checker starts from the characters you used, then charges far less for the parts attackers guess early: common passwords and words, years, repeats, runs like abc or 123, and keys next to each other.
What score should I aim for?
Strong (64 bits or more) holds up for decades against offline guessing on a fast hash. For a password manager's master password or an encrypted file, which can be attacked offline with no limit on tries, aim for Very strong (90 bits or more). A random 16-character password with mixed character types gets you there; a passphrase from our generator needs nine words.
Why does my complex-looking password score low?
Because attackers don't guess one character at a time. They start with leaked passwords and dictionary words, with the usual swaps like a to @ and o to 0, then add years and symbols at the end. P@ssw0rd2024! looks complex but is made entirely of those pieces.
Does a strong score mean my password is safe?
No. A password can score well and already be in a breach list, or be reused on a site that leaked it. Check it with the breached password checker, use it in one place only, and turn on two-factor sign-in where you can.
How accurate are the crack times?
They're averages: half the guesses at a fixed speed. Offline assumes 10 billion guesses a second against a fast hash such as MD5 or SHA-1; slow hashes like bcrypt or Argon2 make that thousands of times slower. Online assumes 10,000 a second against a login that doesn't throttle well. Treat them as orders of magnitude.
Why does the password generator give a different number?
The generator knows exactly how its passwords were made, so it reports their entropy exactly. The checker only sees the finished string and has to guess how it was built, so its number is a rough ceiling: the real strength can be lower, never higher.