Password strength checker
Estimate password strength without sending it anywhere.
- Length
- —
- Character classes
- —
- Estimated entropy
- —
- Estimated crack time
- —
What makes a strong password
- Length matters most. A 16-character passphrase beats an 8-character "complex" password.
- Avoid common patterns. "Password1!", dates, keyboard walks (qwerty, asdf), and sequential digits are all quickly cracked.
- Use unique passwords. A password manager lets you use a different long password on every site without memorising them.
- Turn on two-factor auth wherever it's offered. Even a strong password isn't enough if the site is breached.
Crack-time estimates assume an offline attack at 10 billion guesses per second against a fast hash (e.g. unsalted MD5). Bcrypt or Argon2 would take vastly longer. Real-world outcomes depend on how the target system stores passwords.
About this tool
"Looks random" and "is strong" are not the same thing, and most password meters confuse them. This checker estimates how long your password would survive an attacker running fast offline hardware — on the order of 10 billion guesses per second — and, more usefully, tells you why it's weak: common passwords, keyboard walks like qwerty, dictionary words, year numbers, and repeated characters. It runs entirely in your browser. Your password is never sent to our server, never logged, and never stored — close the tab and it's gone.
The reason the verdict often disagrees with a sign-up form is that it measures guessability, not composition. The classic rules — one uppercase, one number, one symbol — reward P@ssw0rd1, which an attacker's wordlist cracks in seconds because those substitutions are the first ones every cracking tool tries. Meanwhile a passphrase of four plain, unrelated words is far harder to guess despite breaking every "must contain a symbol" rule. Length and unpredictability beat decoration almost every time.
Use the findings, not just the headline time. If it flags a keyboard pattern or a known-breached password, change that specific thing rather than bolting a ! onto the end. And treat the crack-time number as a relative guide, not a promise: the real figure depends on the attacker's hardware and whether the site stored your password with a slow hash. "Centuries" means comfortably strong; "hours" means pick something else.
How to use this tool
-
Type or paste a password
The checker evaluates it as you type — no submit button, no "check now" step. Each keystroke re-runs the scoring locally in your browser.
-
Read the strength estimate
You get a score (0-4), an estimated time to crack, and specific pattern feedback — "contains a dictionary word", "common keyboard sequence", "appended year". The feedback is more useful than the score; it tells you why the password is weak.
-
Close the tab when done
The password never leaves your browser; closing the tab discards it from memory. Nothing is logged, nothing is sent to the server, and the field doesn't autosave.
Frequently asked questions
How is this different from the meter on sign-up forms?
Most signup meters check only length and character classes. This one also looks at common-password lists, keyboard sequences like "qwerty" and "1234", year numbers, and repeating characters — and it reports an estimated crack time instead of a vague "weak / medium / strong".
Why is a 12-character random string stronger than 8 characters of mixed case?
Length adds entropy faster than character diversity. Each extra character multiplies the search space by the pool size. A 12-char lowercase-only password beats an 8-char complex one by a wide margin — which is why passphrases work so well.
Are the crack-time estimates realistic?
The 10 billion guesses-per-second rate assumes a fast hash like unsalted MD5 and modern attack hardware. Sites that use bcrypt or Argon2 slow attackers by a factor of millions, so the same password would be vastly harder to crack there. Treat the number as a worst case.
Why does this rate '12345678' as longer-but-weaker than 'tablecorrectstaple'?
Strength isn't length. It's entropy — how unpredictable the password is to a guessing algorithm. '12345678' is the most common password on earth; it falls in microseconds. 'tablecorrectstaple' is three uncommon words concatenated; even targeted attacks need hours.
Should I trust the time-to-crack number?
As a relative gauge, yes. As an absolute number, no. The real time depends on the attacker's hardware, what hashing the service used, and whether they have a dictionary tailored to you. Treat 'years' as 'safe enough for most threats' and 'minutes' as 'change it.'
Troubleshooting
- It rates my policy-compliant password as weak
Composition rules (one upper, one number, one symbol) aren't the same as being hard to guess.
P@ssw0rd1ticks every box and still falls in seconds because the substitutions are predictable. A longer passphrase of plain words scores better despite "breaking" the rules.- Nothing happens as I type
The estimate is computed live in your browser, so it needs JavaScript enabled. A script-blocking extension or a locked-down corporate browser can stop it. The upside is the same mechanism that proves your password is never sent anywhere.
- Two similar passwords get very different scores
One matched a pattern — a dictionary word, a keyboard walk, a date, or a known-breached password — and got penalised for it. The checker scores predictability, not just the mix of characters, so a small change that breaks a pattern can move the score a lot.
- The crack-time number looks unrealistic
It assumes a fixed guess rate (~10 billion/second) against a fast offline attack. Real attackers vary, and a password caught in a data breach is cracked instantly regardless of length. Read the time as a relative guide, not a guarantee.