Password Strength Checker
Estimate how strong a password is — privately, in your browser.
How to use the Password Strength Checker
- Type the password you want to check.
- Read its estimated entropy and strength.
- Nothing you type is sent anywhere.
About the Password Strength Checker
This checker estimates how hard a password is to guess from two things: its length and the size of its character pool. It adds 26 for lowercase letters, 26 for uppercase, 10 for digits and 33 for symbols, then computes entropy as length × log2(pool) in bits. From that it shows a crack-time estimate at one clearly stated rate — 10 billion guesses per second, the kind of speed an offline attacker gets against a fast hash — and labels the result from very weak to very strong. Crucially, it runs entirely in your browser: nothing you type is transmitted, which matters because you should never paste a real password into a site that sends it somewhere.
The big caveat is that entropy assumes a truly random password. A human-made one like “Password123!” scores high on paper but falls in moments, because real attackers try common words, substitutions and leaked passwords first. Treat this as a learning and estimating tool, not a verdict on whether a specific account is safe.
To create a genuinely random password rather than judge one, use the password generator; for short numeric codes, see the PIN generator.
Frequently asked questions
Is my password sent to a server?
No. The whole calculation runs in your browser and nothing you type is transmitted, logged or stored. That is deliberate — you should never paste a real password somewhere that sends it away.
What is entropy in bits?
It is a measure of how many guesses a password represents, calculated here as length times log2 of the character pool. More length and a wider mix of character types raise the bits, and each extra bit doubles the guessing effort.
How is the crack time worked out?
From the entropy at one stated rate — 10 billion guesses per second, an offline attack on a fast hash. It is a ballpark for comparison, not a promise; a slower or faster attacker changes the number.
Why does “Password123!” score as strong when it is not?
Because entropy assumes randomness. That password has high nominal entropy, but attackers try common words, patterns and leaked passwords first, so a predictable one falls far faster than its bit count suggests.
Does a strong score mean my account is safe?
No. This estimates one password in isolation. Reuse across sites, phishing, malware or a data breach can expose it regardless of strength, so treat this as a learning tool, not a guarantee.