Password strength checker
Type a password to see an entropy estimate, how long guessing it would take at four different attack speeds, and which weaknesses were found. Everything is calculated in your browser; the password is never sent anywhere.
Runs in your browser: nothing you enter is sent anywhere.
How to use it
- Type or paste a password. Use Show to check what you typed.
- Read the strength and entropy, then the time to guess in four situations.
- Fix whatever is marked as failed in the checks and see the numbers change.
What the checks look for
- Length and character types: longer is the biggest factor. Each extra character multiplies the work.
- Very common passwords: a built-in list of about 200, including simple look-alike spellings such as
p@ssw0rd. Matching pieces of at least 4 characters count too.
- Sequences: runs of consecutive characters like
abcd or 9876.
- Repeats:
aaaa, abab, 123123.
- Keyboard walks: four or more neighbouring keys on one row, such as
qwer or asdf, in either direction.
- Years: 1900–2099 as a separate 4-digit number.
A worked example
xK9#mP2$vL7!qR4& has 16 characters from an alphabet of 95 (26 + 26 + 10 + 33). Entropy = 16 × log2(95) ≈ 105 bits. Average guesses = 2^104, far beyond any attacker. In contrast, Password is the first entry of the common-password list, so it costs about 2 bits: it falls in well under a second.
Tips
Length and randomness beat clever substitutions. A password manager and the password generator on this site make random passwords with high entropy; use a different one for every account.
Frequently asked questions
Is my password sent to a server?
No. The check is a script that runs in your browser tab. Nothing is sent, stored or logged. Even so, avoid typing a password you use for something important into any web page; test a similar one instead.
How is the entropy estimated?
The password is split into the cheapest pieces. A normal character costs log2 of the alphabet size (26 lowercase, 26 uppercase, 10 digits, 33 ASCII symbols, 100 for other characters) in bits. A very common password, a sequence, a repeat, a keyboard walk or a year costs only a few bits. The lowest total wins.
Where do the guess rates come from?
They are round example speeds, not measurements: 100 per hour for a login page with rate limiting, 10 per second without it, 10 thousand per second for a stolen database stored with a slow hash such as bcrypt, and 10 billion per second for a fast hash on graphics cards. Real attackers vary a lot.
Why is the time "average"?
An attacker who tries every possibility finds the password halfway through on average, so the tool uses half of 2 to the power of the entropy in bits.
Can a password rated strong still be bad?
Yes. The built-in list has only about 200 very common passwords, and no dictionary of words, names or leaked passwords. A phrase made of ordinary words with a few substitutions may be weaker than the estimate. A password reused on several sites is unsafe whatever its strength.