Password Strength Checker
Check password strength by real entropy, not a coloured bar. Estimates crack time, detects patterns and common words. Runs offline in your browser.
Input
Result
The result appears here as you type.
What this tool is for
Most strength meters count character types and call anything with a capital letter and a digit "strong", which is why Password1! scores well and is cracked instantly. This one estimates entropy in bits, penalises dictionary words, keyboard runs, repeats and dates, and turns the result into an estimated time to crack under offline attack.
How to use it
- Type a password, or something close to the one you use so you do not enter the real one.
- Read the entropy in bits and the estimated crack time.
- Read the warnings: they name the specific pattern that weakened the score.
Frequently asked questions
Is it safe to type my real password here?
The analysis runs in your browser and nothing is sent or stored. Even so, the good habit is to test a password of the same shape rather than the exact one you use.
What does the crack time assume?
An offline attack against a fast hash at roughly ten billion guesses per second, which is a modern GPU rig. A site that hashes properly with bcrypt or Argon2 is far slower to attack, so treat the number as a worst case.
How many bits of entropy are enough?
Below 40 bits is weak, around 60 is reasonable for an ordinary account, and 80 or more is comfortable for anything valuable.