Password Strength Checker

Check a password's strength using entropy estimation and a common-password check, with an estimated brute-force crack time and specific suggestions to improve it — nothing is sent anywhere.

How the strength score works

The checker estimates entropy — how many guesses an attacker would need — from your password's length and the types of characters it uses:

• Lowercase letters add 26 possible characters
• Uppercase letters add 26
• Numbers add 10
• Symbols add 32

Entropy = length × log₂(number of possible characters). It also checks your password against a list of very common passwords, which are rated very weak no matter how they look.

Length beats complexity

Assuming an attacker can try 10 billion guesses a second, here's how long it would take to try every combination:

Password type	Entropy	Time to try every combination
8 lowercase letters	37.6 bits	about 21 seconds
8 letters (mixed case) and numbers	47.6 bits	about 6 hours
8 characters, all types	52.4 bits	about 7 days
12 characters, all types	78.7 bits	about 1.5 million years
20 lowercase letters	94.0 bits	billions of years

Adding length grows the number of combinations much faster than adding symbols, which is why a long passphrase can be stronger than a short, complicated password.

Tips for strong passwords

• Use at least 12–16 characters. For important accounts, longer is better.
• Try a passphrase: four or more random, unrelated words are long and easy to remember.
• Never reuse passwords. If one site is breached, attackers try the same email and password on other sites.
• Use a password manager to create and store a unique password for every account.
• Turn on two-factor authentication wherever it's offered — it protects you even if a password leaks.

Need a new one? The password generator creates random passwords and passphrases in your browser.

Frequently asked questions

Is my password sent anywhere?

No — everything is checked entirely in your browser using JavaScript. Nothing you type here is transmitted, logged, or stored anywhere.

What is entropy?

A measure (in bits) of how unpredictable a password is, based on its length and the variety of character types used. Higher entropy means more possible combinations an attacker would have to try.

How is crack time estimated?

It's a rough estimate assuming an offline brute-force attack at a fast guessing rate — real-world crack time varies a lot based on how the password is stored and the attacker's resources, so treat this as a relative comparison, not an exact prediction.

Why is my password rated weak even though it has symbols?

Short passwords are weak even with symbols, and common patterns like "Password1!" are among the first things attackers try. Make it longer, and avoid dictionary words with predictable substitutions like @ for a or 0 for o.

Should I test my real password here?

The check runs entirely in your browser and nothing is sent anywhere. Even so, as a general habit, it's safer to test a similar password rather than your exact one.