Password Strength Checker
Analyze a password and see strength estimates, length, character diversity, and possible vulnerabilities.
Password strength: —
Possible vulnerabilities
The entire analysis runs locally in your browser — your password is never sent, logged, or stored on any server. Crack-time estimates are educational approximations based on a common offline attack scenario, and can vary a lot depending on the attack method and the hashing algorithm used by the service.
This password strength checker analyzes the length, the diversity of character types (lowercase, uppercase, digits, and symbols), and predictable patterns in a password — like sequences, repeated characters, and known leaked passwords — to estimate its entropy (in bits) and roughly how long a brute-force attack would take to crack it. The entire analysis runs in your browser, without sending the password anywhere. Use it to test a password before adopting it, not to check passwords you already use on real, important accounts.
How to use
- Type or paste the password you want to test into the field.
- Watch the strength, length, character diversity, and estimated entropy update in real time.
- Check the vulnerability list to see exactly what's making the password weaker.
Worked example
The password "123456" is 6 characters, uses only digits, and is among the most leaked passwords in the world — result: very weak, cracked instantly. The password "Tr8!qXm2#vLp9", on the other hand, is 13 characters, mixes uppercase, lowercase, digits, and symbols, with no sequences or repeats — result: very strong, with an estimated crack time measured in centuries under the attack scenario considered.
Frequently asked questions
Is my password saved or sent to a server?
No. The entire analysis is done locally, in JavaScript running in your browser. The password is never transmitted over the internet or saved anywhere, not even on this site's servers.
What is password entropy?
It's a measure, in bits, of how unpredictable a password is. The higher the entropy, the more combinations an attacker would need to try. It's calculated from the password's length and the variety of characters used, with penalties applied when predictable patterns are detected.
Is the estimated crack time exact?
No, it's an educational approximation. The real time depends on factors like the hashing algorithm the service uses (some are far slower to attack than others), the attacker's computing power, and whether the password has already appeared in known leaks — in that case it could be tried almost instantly from ready-made lists, regardless of the calculated entropy.
What should I do if my password is rated weak?
Increase the length (12+ characters is a good target), mix uppercase, lowercase, digits, and symbols, and avoid sequences, repeats, dictionary words, and personal details like your name or birth date. A good alternative is to use a random password generator.
Why does using several character types matter so much?
Each additional character type increases the size of the "alphabet" available for every position in the password, which makes the number of possible combinations grow exponentially. An 8-character password with only lowercase letters is far weaker than an 8-character password mixing letters, digits, and symbols.
Is a long password without symbols better than a short, complex one?
Usually, yes. Length carries enormous weight in total entropy. A long, memorable passphrase like "BlueDogEatsGreenApple42" tends to be both stronger and easier to remember than a short password packed with symbols, like "P@s5!".