Password Strength Checker
See how long a password would actually survive — and why length beats symbols.
Never paste a production secret into any website, including this one. Test with a password of the same shape instead.
How this works
The character set is worked out from which kinds of character appear, and multiplied by the length to give an entropy figure in bits. That figure is then reduced for the patterns that make passwords guessable in practice — keyboard runs, repeated characters, a word followed by numbers, an embedded year. The result is converted into an estimated time to crack at three realistic attack speeds.
What the results mean
- Effective entropy
- Bits of genuine unpredictability after predictable patterns are subtracted. Under 35 bits is weak, 60 or more is strong against brute force.
- Online attack
- Guessing against a live login that rate-limits attempts. Almost any password survives this; it is the least interesting case.
- Offline, bcrypt
- The attacker has the password database and it was hashed properly. This is the realistic case for a well-built site that has been breached.
- Offline, fast hash on GPUs
- The database was hashed with something fast like MD5 or SHA-1. This is the worst realistic case, and the one worth designing your password against.
Common problems and fixes
- My password scores lower here than on other strength meters
- Most meters only count length and character variety. This one subtracts for patterns that cracking software tries first, so a password like Summer2024! scores far lower here — which reflects how it would actually fare.
- A long passphrase scores better than a complex short one
- That is correct and intentional. Four unrelated words beat eight mixed characters on both strength and memorability, which is why passphrases are now the standard advice.
Frequently asked questions
Is my password sent to a server?
No. There is no network request on this page — no analytics on what you type, no ads, no third-party scripts. The page also ships a Content-Security-Policy that blocks outbound connections, so you can verify the claim in the page source rather than taking our word for it.
Should I type my real password here?
As a rule, do not type a real password into any website, including this one. Test a password of the same shape and length instead. The habit matters more than any single page’s trustworthiness.
Does this tell me if my password has been breached?
No. That requires checking against a breach database, which would mean sending something derived from your password over the network — incompatible with this page making no requests at all. A password manager is the right tool for breach monitoring.