Password Strength Checker
Test your password’s strength and crack time — privately.
Enter a password to see its strength
Nothing you type here is transmitted, logged or stored — every check runs locally in your browser with JavaScript, so it's safe to test a real password.
How to use the Password Strength Checker
- 1 Type a password into the box (use show/hide to check it visually).
- 2 Read the strength meter, estimated entropy and crack-time estimates.
- 3 Follow the suggestions to fix specific weaknesses, like repeated characters or common words.
Examples
- ▸ "password123" is cracked almost instantly — it matches a common password list.
- ▸ A random 16-character mix of cases, digits and symbols can take centuries to brute-force offline.
Frequently asked questions
Is my password sent anywhere when I type it here?
No. Every check runs entirely in your browser with JavaScript — nothing you type is transmitted, logged or stored anywhere, even briefly. You can safely test your real password.
How is the strength score calculated?
It combines an entropy estimate (based on length and character variety) with penalties for risky patterns: sequences like "1234" or "abcd", keyboard runs like "qwerty", repeated characters, years, and matches against a list of the most common leaked passwords.
What do the crack-time estimates mean?
They estimate how long a brute-force attack would take at two speeds: an "online" guess rate (about 10,000 guesses/second, throttled by a login form) and an "offline" rate (about 10 billion guesses/second, for a stolen password database on fast hardware).
Why is a long random password stronger than a complex short one?
Each extra character multiplies the number of possible combinations, while adding a symbol only multiplies by a small factor. A long passphrase like "correct-horse-battery-staple" is typically far stronger and easier to remember than a short "P@ssw0rd!".
Why did a long password still score poorly?
Length alone is not enough — dictionary words, keyboard patterns, and predictable substitutions (like "@" for "a") are exactly what password crackers try first, so the score also penalizes those patterns even in long passwords.