Password strength tester. Entropy, not vibes.
Your password is analysed locally with JavaScript and never transmitted, logged, or stored. Nothing leaves this tab, close it and the password is gone. It is never autofilled or saved.
Checklist
How crack time is estimated
We estimate entropy as bits = length × log₂(pool size), where the pool is only the character sets you actually used (26 lowercase, 26 uppercase, 10 digits, ~33 symbols). When a common password, dictionary word, sequence, or repetition is detected, the effective entropy is reduced because an attacker would try those first.
Crack time assumes an offline attacker who has the leaked hash and guesses at 10 billion guesses/sec (a strong consumer GPU against a fast hash like unsalted SHA-1):
*This is a guide, not a guarantee. A slow, salted hash (bcrypt/argon2) would take far longer to crack; a weak reused password could fall instantly to a credential-stuffing list regardless of entropy. Use a password manager and unique passwords everywhere.
How to use the Password Strength Tester
This tester estimates how hard a password would be to guess. It multiplies the length by log2 of the character pool you used, cuts that score when it spots a common password, a dictionary word, a sequence or a repeat, and turns the result into a rating and a crack time. Use it to check a password pattern before you rely on it.
Step by step
-
Type or paste a password
Click the field under Enter a password to test and type or paste. Every number on the page updates with each key you press. The field is masked like any password box.
-
Show it if you need to check it
Press the eye button at the end of the field (Show or hide password) to reveal the characters, and press it again to mask them.
-
Read the rating and the bar
The label above the bar reads Very weak, Weak, Fair, Strong or Excellent, and the line beside it shows the effective bits of entropy. The bar fills and changes color as the score rises.
-
Check the three boxes
Length counts the characters. Character pool adds 26 for lowercase, 26 for uppercase, 10 for digits and 33 for any symbol or space you used. Crack time is the average time to guess it at 10 billion guesses a second.
-
Work through the checklist
The Checklist marks each rule with a tick or a cross, including At least 12 characters, Not a common password and No sequences or repeats. Under it, How to make it stronger lists up to four specific fixes.
-
Compare attack speeds
How crack time is estimated shows one example 14 character password against four attack speeds, from a throttled online attack at 100 guesses a second to a large GPU cluster at a trillion a second.
Reading the result
- The ratings follow the effective bits: under 28 is Very weak, under 40 Weak, under 60 Fair, under 80 Strong, and 80 or more Excellent.
- Password1 is on the built in list of common passwords, so its score is capped at 12 bits. It shows Very weak and a crack time of instantly.
- Twelve random characters mixing uppercase, lowercase and digits give a pool of 62 and about 71 bits, which is Strong at roughly 5.1 thousand years, as long as no sequence, repeat or common word is found.
- A sequence such as abc, 123 or qwerty cuts the bits by 40%, three of the same character in a row cuts them by 30%, and a common word inside the password cuts them by 35%.
Tips and common mistakes
- Length does the most work. Adding characters raises the score faster than swapping letters for symbols.
- Simple swaps do not fool the checker. It undoes swaps such as @ or 4 for a, 3 for e and $ or 5 for s before it looks for common words, and attackers do the same.
- The crack time assumes a fast, unsalted hash. A site that stores passwords with bcrypt or argon2 is far slower to attack, but a reused password can be tried straight from a breach list in seconds whatever its score.
- The common password list is short and built into the page. Passing that check does not prove a password has never appeared in a breach.
- Use a password manager to generate and store a different random password for every account.
Privacy and limits
The password is analyzed by JavaScript in your browser. It is never sent anywhere, logged or saved by the page. Closing the tab clears it, and the tester keeps working offline once the page has loaded.
Everything a strength check should show.
- Measure entropy in bits for any password you type or paste, updated live as you type.
- See an estimated crack time across four attacker scenarios, online throttled, slow salted hash, fast single GPU, and a large GPU cluster.
- Run a security checklist covering length, character mix, common passwords, dictionary words, sequences and repeats.
- Get fix-it tips that name exactly what is weakening your password and how to strengthen it.
- Toggle visibility to verify what you typed without leaving it exposed on screen.
- Test privately: everything runs in your browser and nothing is ever uploaded.
Frequently asked questions.
Is the Password Strength Tester free?
Is my password uploaded or stored anywhere?
What does entropy in bits actually mean?
How is the crack time calculated?
Should I type my real password in here?
Does it work offline?
Published · Last updated .
