Password Strength Checker
Test how strong a password really is — entropy in bits, an offline time-to-crack estimate and a plain-English security checklist.
Checked entirely in your browser. Nothing is sent to a server, logged or stored.
Security checklist
- At least 12 characters — not met
- At least 16 characters (recommended) — not met
- Mixes upper and lower case — not met
- Includes a number — not met
- Includes a symbol — not met
- No common word or name — not met
- No keyboard runs or repeats — not met
- No year or date pattern — not met
Your password strength
Enter a password to see its strength, entropy in bits and an estimated time to crack.
How it works
A password strength checker estimates how hard your password would be for an attacker to guess — not whether it satisfies some website's arbitrary rules. Those two things are very different, which is why P@ssw0rd1 passes most signup forms and would survive roughly a second of a real attack.
How it works
Entropy = length × log₂(size of character pool)- Penalties are deducted for dictionary words, names, repeated characters, keyboard runs and year patterns.
Time to crack = 2^(bits − 1) ÷ 10,000,000,000 guesses per second
The character pool is 26 for lower case, another 26 for upper, 10 for digits and about 33 for common symbols — so a password using all four types draws on 95 possible characters per position.
A worked example
Summer2026! looks respectable: 11 characters with upper case, digits and a symbol. But it contains a dictionary word, a year and the classic trailing exclamation mark, so a pattern-aware attack finds it in minutes. The passphrase otter-cinema-basalt-19 is longer, easier to remember and carries far more real entropy because nothing about it is guessable from a template.
How to interpret your result
- Under 28 bits — very weak. Cracked essentially instantly.
- 28–40 bits — weak. Fine for a throwaway forum, nothing else.
- 40–60 bits — reasonable. Acceptable for low-value accounts.
- 60–80 bits — strong. A sensible target for email, banking and work accounts.
- Over 80 bits — very strong. Appropriate for password manager master passwords.
Common real-world uses
- Sanity-checking a new password before you commit to it.
- Showing colleagues why a "complex-looking" password isn't strong.
- Setting realistic password policies for a team or small business.
- Comparing a memorable passphrase against a short random string.
Related tools: Random Password Generator · UUID Generator · Base64 Encoder / Decoder · URL Encoder / Decoder