Password Strength Checker
Judge a password by what an attacker would actually try. Free, and runs entirely in your browser — nothing you enter is uploaded or stored.
About Password Strength
Most strength meters multiply length by the size of the alphabet and show you the answer. By that arithmetic Password1! has ten characters from all four character classes and is worth about sixty-five bits — a century of guessing. It is one of the most-used passwords in the world and falls in the first thousand guesses. The arithmetic is not wrong; it answers the wrong question, because nobody attacks a password by enumerating the alphabet. They try the likely things first.
So this looks for what makes a password likely — a word from a wordlist, a walk along a keyboard row, a run in counting order, a repeat, a year, and the digit-for-letter swaps that every cracking tool undoes automatically — prices each one, and subtracts it. Both numbers are shown: what the alphabet suggests, and what is left. Every deduction is named, so the figure can be argued with rather than believed.
The times are given for four kinds of attacker, because 'how long would this take to crack' has no single answer. The same password that would last centuries against a login form falls in seconds against a stolen database that was hashed with something fast, and the difference is the defender's choice of hash, not yours.
Where it helps
- Charges for dictionary words, keyboard walks, runs, repeats and years rather than counting characters.
- Undoes the usual letter-for-digit swaps, which is the first thing a cracking wordlist does.
- Shows the estimate before and after deductions, so the gap between the two is visible.
- Gives times for four attackers, because the answer depends far more on how it was stored than on the password.
- Runs in this browser. What you type is never sent, stored or logged.
Limits
- A high score is not proof of a good password. A pattern this does not recognise is a pattern it does not charge for, so the figure is an upper bound on strength rather than a guarantee.
- The wordlists here are short — the passwords and words that top every breach list, not a corpus of millions. A real cracking rig carries far more.
- It cannot know whether the password has already appeared in a breach, which matters more than its shape. Checking that means sending something about it somewhere, which this tool will not do.
- It says nothing about whether the password is reused, which is the single most common way accounts are actually lost.
Frequently asked questions
Is it safe to type my real password here?
It is checked by code already in your browser and no request carries it — you can watch the network panel stay empty. If you would rather not, type something with the same shape: the same length, the same character classes, the same structure.
Why is my password worth fewer bits than its length suggests?
Because part of it is predictable. The findings list every deduction and what it was for; what is left is the part an attacker would actually have to search.
Which of the four times should I care about?
The one for a stolen database hashed with something fast, since you cannot know how a site stores your password and should assume the worst. The login-form figure only applies while the attacker is stuck going through the front door.
What actually makes a password strong?
Length, and not being a thing anybody would guess. Four or five unrelated words beat a short string of symbols, and are easier to type. Better still, let a manager generate it and never see it.
Related tools
- Password Generator — Strong random passwords with an entropy estimate
- Key Derivation — Stretch a passphrase into key material with PBKDF2, scrypt or Argon2id
- Hash Generator — SHA-2, SHA-3, BLAKE and legacy digests, in any encoding
- Text Encryption — AES-256-GCM with a PBKDF2 passphrase
- MD5 Generator — MD5 digests, with a plain account of what they are still good for
- HMAC Generator — Keyed message authentication codes
More Security & Cryptography tools
- Hash Generator — SHA-2, SHA-3, BLAKE and legacy digests, in any encoding
- MD5 Generator — MD5 digests, with a plain account of what they are still good for
- HMAC Generator — Keyed message authentication codes
- Key Derivation — Stretch a passphrase into key material with PBKDF2, scrypt or Argon2id
- Password Generator — Strong random passwords with an entropy estimate
- JWK Generator — A JSON Web Key for a JOSE algorithm, with its key set and thumbprint id
- Key Pair Generator — RSA and elliptic-curve key pairs, generated in this tab and never sent
- TOTP / HOTP Generator — Two-factor codes, the QR code to enrol with, and why one did not match
- Text Encryption — AES-256-GCM with a PBKDF2 passphrase
- Bcrypt Generator — Hash a password with bcrypt, verify one against a hash, or read what a hash is made of