Password Strength Checker
Type or paste a password to see its entropy, estimated crack times and weaknesses. The check runs entirely offline in your browser - Nothing is transmitted.
Why Most Strength Meters Lie
Type P@ssw0rd2026! into a naive strength meter and it lights up green:
13 characters, all four types, textbook "complexity." Cracking software disagrees -
it's a dictionary word with the exact substitutions (a→@, o→0)
and the exact suffix pattern (year + !) that rule-based cracking tries in
its first few seconds.
The gap exists because naive meters compute theoretical entropy (pool size ^ length) while attackers exploit how humans actually build passwords. Real-world cracking runs wordlists with mutation rules before it ever brute-forces, so:
- A 13-character "complex" pattern can fall in seconds,
- while 12 truly random characters survive thousands of years.
This checker penalizes the patterns first - Dictionary roots, keyboard walks, years, repeats - Then scores what entropy honestly remains. If two meters disagree, trust the pessimist.
How the Score Is Calculated
Entropy, then penalties
We start from information entropy - The size of the character pool raised to the power of the length, expressed in bits. Then we subtract penalties for the patterns cracking tools exploit:
- Dictionary words - Even with l33t swaps
- Keyboard runs like
qwerand1234 - Repeated characters and years (2026 is not a secret)
- The world's most common passwords
The result maps to crack-time estimates at three realistic attack speeds. The math is explained in our entropy guide and how hackers crack passwords.
Is it safe to type a real password here?
The analysis runs 100% in your browser with no network requests - You can open this page, go offline, and it still works. Still, security best practice is to test similar passwords rather than your actual ones, then generate a fresh one with the password generator or a passphrase generator.
Strength is only half the question - a strong password is still worthless if it already leaked. Run it through the password breach check too, and if it shows up, read what to do after a data breach.
How to Use the Password Strength Checker
Type or paste a password
Use a variation of your real password rather than the exact one - Testing similar structures gives the same insight.
Read the entropy score
The meter shows effective bits after pattern penalties for dictionary words, sequences, years and repeats.
Check all three crack times
A password that survives online attack can still fall instantly offline - Judge by the GPU column.
Fix what it flags
Regenerate with the password generator until you see 'Very strong' and no findings.
Realistic attack speeds this checker models
| Scenario | Speed | Who does this | What survives |
|---|---|---|---|
| Online, throttled | ~100 guesses/sec | Botnets against login pages | Almost any non-top-1000 password |
| Offline vs bcrypt | ~100K guesses/sec | Attacker with a stolen, well-hashed database | 12+ random characters |
| Offline vs MD5/SHA-1 | ~100B guesses/sec | One GPU rig vs legacy hashes | Only 14+ random characters or 5+ word passphrases |
Password Strength Checker - FAQ
Why does this checker disagree with other strength meters?
What is a good entropy score in bits?
Are the crack times guaranteed?
Does my password get uploaded when I test it?
More questions about passwords and security? Browse the security guides.
More Free Tools
Password Generator →2FA Code Generator
Generate TOTP secrets, QR codes and live 6-digit codes.
Password Breach Check
See if a password appears in known data breaches - Privately, via k-anonymity.
Password Generator
Random passwords with full control over length and characters.
Passphrase Generator
Memorable multi-word passphrases (Diceware style).
PIN Generator
Random 4–12 digit PIN codes with no weak patterns.
Username Generator
Random, non-identifying usernames for new accounts.