Developer
Password Strength Checker
Type a password to see how long it would actually survive, from a rate-limited login form to a GPU rig guessing ten billion times a second. The score is based on effective entropy rather than the tick-box rules most sign-up forms use, so a password is marked down for leaked-list membership, keyboard runs, repeated characters, and years — the shortcuts real attackers try first. Nothing is transmitted: there is no server behind this page.
Nothing is sent anywhere — the check runs entirely in this page.
Time to crack
| Attack scenario | Estimated time |
|---|
What the checker found
How to improve it
Need a better one? The password generator builds long random passwords in the same browser tab.
Is this safe to use?
The password you type is analysed by JavaScript running in this page and is never sent over the network, stored, or logged — there is no server to send it to. You can confirm that by opening your browser's network panel, or by disconnecting from the internet: the page keeps working. That is also why it does not check your password against the Have I Been Pwned database, which would mean transmitting a hash of it to a third party. Even so, the safest habit is to test a pattern like the password you use rather than the real one.
Why length beats complexity
Each extra character multiplies the number of guesses needed, while swapping a for @ merely adds one guess to a list attackers already run. A sixteen-character passphrase of ordinary words is far harder to crack than eight characters of punctuation soup, and much easier to remember and type. That is why NIST dropped its composition rules in favour of a length minimum, and why this checker weights length far more heavily than the character-class boxes most sign-up forms still insist on.
How the estimate is calculated
The starting point is entropy: the password's length multiplied by the base-2 logarithm of its alphabet. That figure alone flatters anything human-chosen, so it is reduced for every predictable pattern found — a leaked password costs only as many guesses as its position in the list, a run like abcd or qwerty costs roughly one guess rather than four characters of randomness, and a year costs almost nothing. The times assume half the remaining keyspace and four attack speeds, from a rate-limited login form to a GPU rig running ten billion guesses a second.
What actually protects an account
Most accounts are lost to reuse and phishing, not to brute force. A password that appeared in any breach is already in the wordlists, so uniqueness matters more than cleverness: one strong password used in three places is three accounts at risk. Use a password manager so every login can have its own long random string, turn on two-factor authentication wherever it is offered, and stop rotating passwords on a schedule — forced expiry pushes people towards Summer2026! then Autumn2026!.
Frequently asked questions
Is it safe to type my real password here?
The analysis runs entirely in your browser with no network request, so the password is never transmitted, stored, or logged, and the page works with the internet disconnected. That said, the safest habit with any strength checker is to test a password shaped like yours rather than the exact one you use.
Why does my password with symbols score badly?
Because attackers do not guess randomly. Swapping a for @ or adding a 1 at the end are the first substitutions every cracking wordlist tries, so Password123! is close to worthless despite ticking every character-class box. Length is what actually multiplies the work; sixteen ordinary characters beats eight clever ones.
What is entropy in bits?
It is a measure of how many guesses a password is worth: each extra bit doubles that number. Roughly, under 28 bits is trivially broken, 60 bits resists casual offline attacks, and 80 bits or more is comfortable against a serious GPU rig. The figure shown here is reduced from the raw calculation to account for the predictable patterns found in your password.
Does this check whether my password has been in a breach?
No, and that is deliberate. Breach lookups work by sending part of a hash of your password to a third-party service, which would break the promise that nothing leaves your browser. The tool does check a built-in list of the most-used leaked passwords locally, which catches the ones tried first.
How often should I change my password?
Only when you have reason to think it was exposed. Scheduled expiry is now advised against by NIST and others, because it pushes people towards predictable variations like Summer2026 followed by Autumn2026. A long unique password per account, kept in a password manager and paired with two-factor authentication, protects far more than rotation ever did.