💪 Password Strength Checker
Score your password live with crack-time estimates and practical improvement tips. Useful for checking whether your passwords are actually strong. Free, unlimited, private — works entirely in your browser.
How to use
- Type your password into the box — it is scored live as you type.
- Read the strength meter, the score out of 100, and the crack-time estimate.
- Follow the tips under “How to improve” to strengthen it — each change updates the score instantly.
- Test variations until the meter shows Strong (80+), then use the Password Generator to create your final random password.
FAQ
Is it really free?
Yes — every tool on this site is 100% free with no limits, no signup and no watermarks.
Is my password sent anywhere?
No. All analysis happens locally in your browser. Your password never leaves your device.
How is the strength score calculated?
The checker measures entropy: password length multiplied by log₂ of the character pool (26 lowercase, 26 uppercase, 10 digits, 32 symbols — more if you use non-Latin characters). The bit total is scaled to a 0–100 score: Weak below 30, Fair below 55, Good below 80, Strong at 80 and above.
What does the crack-time estimate assume?
It assumes an attacker trying 10 billion guesses per second — roughly a modern GPU cracking rig — and shows the average time to guess your password. “Centuries” means brute force is infeasible, but dictionary attacks on common words are far faster.
My familiar phrase scored well — is it actually safe?
Not necessarily. The meter analyzes structure (length and character variety), not whether your password appears in breach databases or dictionaries. Long common phrases can score well yet fall to dictionary attacks in seconds; random generated passwords are always safer for real accounts.
Can I run this check offline for extra safety?
Yes. All calculations run in local JavaScript with no network calls — disconnect from the internet and the score is identical. That is the simplest proof your password never leaves your device.
Password Strength Checker Guide
Most people judge password strength by feel — "it has a capital letter and a number, so it must be strong." This checker replaces guesswork with math. It measures entropy, the number of bits of unpredictability in your password, and converts that into a 0–100 score plus a crack-time estimate, so you can see exactly how a small change (a few extra characters) makes an enormous difference.
How the score is calculated
Entropy equals password length multiplied by log₂ of the character pool: 26 for lowercase, 26 for uppercase, 10 for digits, 32 for symbols (more if you use non-Latin characters). A 12-character password using all four sets carries about 78 bits of entropy; adding four more characters pushes it past 105 bits. The score scales this to 100: below 30 is Weak, below 55 Fair, below 80 Good, and 80+ Strong. The crack-time estimate assumes an attacker trying 10 billion guesses per second — a modern GPU rig — and shows the average time to succeed.
What the meter can't see
The checker analyzes structure, not history. It doesn't know if your password appeared in a data breach or sits in an attacker's dictionary, so a long familiar phrase like "iloveyou123456!" can score surprisingly well while falling to a dictionary attack in seconds. Real-world attackers try common passwords, leaked databases and predictable substitutions (a→@, e→3) long before brute force. Treat a "Strong" result as necessary but not sufficient: the safest passwords are random ones, which is why this site pairs the checker with a Password Generator.
Pro tips for stronger passwords
Prioritize length over cleverness — appending four random characters to a password multiplies its strength far more than swapping letters for symbols. Never reuse a password between sites; one breach shouldn't endanger every account. Enable two-factor authentication on important accounts, since even the strongest password can be phished. And remember the privacy guarantee: every calculation happens in your browser's JavaScript. You can even disconnect from the internet and re-run the check — identical results, zero data leaving your device.