Password Strength Checker
Test how secure your password is — get an entropy score, estimated crack time, and actionable tips.
Last updated: March 25, 2026
Used 47K+ timesWhat users say
“I use this to show junior devs why "P@ssw0rd" is terrible. The crack time estimate next to the entropy score is eye-opening — finally something that explains *why* a password is weak.”
“The passphrase vs random string comparison genuinely changed how I think about passwords. Simple, educational, and completely private.”
Find this tool useful? Support the project to keep it free!
Buy me a coffeeWhat is Password Strength Checker?
Password strength is determined by two primary factors: length and character diversity. A password's "entropy" — measured in bits — quantifies how many guesses an attacker would need on average. Each additional bit of entropy doubles the number of guesses required. An 8-character lowercase password has approximately 38 bits of entropy (easily cracked in hours with a GPU). A 16-character passphrase with mixed characters has 95+ bits — which would take billions of years to brute-force at current computing speeds.
This tool calculates entropy based on length, character set size, and patterns. It also checks against common substitutions (e.g. 3 for E, @ for A) and dictionary-based patterns that attackers exploit first. All analysis runs entirely in your browser — your password is never transmitted to any server, never stored in any database, and leaves no trace.
How to Use Password Strength Checker
Type your password into the input field — analysis begins instantly
Review the strength bar: Weak (red), Fair (orange), Good (yellow), Strong (green), Very Strong (blue)
Check the entropy score (bits) and estimated crack time shown below the bar
Read the specific improvement tips that appear if the password is below "Strong"
Adjust your password based on the suggestions and watch the score update in real time
Common Use Cases
- Checking a new password before setting it on an account
- Auditing existing passwords to identify which accounts need updated credentials
- Understanding why a specific password is weak (e.g. dictionary word base + number substitution)
- Teaching employees or students what makes passwords resistant to cracking
- Verifying passphrase strength — testing whether "correct horse battery staple" is stronger than "P@ssw0rd!"
- Estimating crack time for compliance reporting (HIPAA, SOC 2, PCI-DSS)
- Testing generated passwords from a password manager before trusting them
Example Input and Output
Compare a classic "clever" substitution password versus a random passphrase:
Example A: P@ssw0rd!
Example B: correct-horse-battery-staple
Example C: Xk9#mP2@vLq7$nR4Example A: P@ssw0rd!
Entropy: 28 bits | Strength: WEAK
Crack time: < 1 hour (dictionary + leet-speak rules)
Example B: correct-horse-battery-staple
Entropy: 53 bits | Strength: GOOD
Crack time: ~3 years (random word combo)
Example C: Xk9#mP2@vLq7$nR4
Entropy: 98 bits | Strength: VERY STRONG
Crack time: Billions of yearsPrivacy Guarantee
Your password is never transmitted. All analysis (entropy calculation, pattern detection, crack time estimation) runs exclusively in your browser. No network request is made. You can use this tool with WiFi disabled.
Use a Password Manager
The best password is one you do not know. Use a password manager (Bitwarden is free and open-source) to generate and store 20+ character random passwords for every site. You only need to remember one strong master password.
Beyond Passwords: Enable 2FA
Even a perfect password can be stolen via phishing, keyloggers, or data breaches. Two-factor authentication (2FA) adds a second layer that attackers cannot crack remotely. Use an authenticator app (Authy, Google Authenticator) — avoid SMS-based 2FA which is vulnerable to SIM-swapping.
Frequently Asked Questions
Is my password sent to a server when I type it here?
What is password entropy and why does it matter?
Why is 'P@ssw0rd!' rated as weak even though it has uppercase, number, and symbol?
How long should a secure password be?
Are passphrases stronger than random character passwords?
Does this check against known leaked passwords (Have I Been Pwned)?
What makes a password crack-resistant for 2025?
How This Tool Works
Strength is calculated using a Shannon entropy formula: bits = log2(charset_size) × length. Character set size is determined by which character classes appear in the password (lowercase: 26, uppercase: 26, digits: 10, symbols: 32). Pattern penalties are applied for dictionary words (using a curated compressed wordlist), date patterns (YYYY, MM/DD), keyboard walks (qwerty, 12345), and common leet-speak substitutions. The crack time estimate is based on a simulated offline attack rate of 10 billion guesses/second (modern GPU cluster) applied against the effective entropy after penalties.
Technical Stack
Security and Auth Workflow
Generate safer credentials, inspect tokens, verify signatures, and compare hash outputs from the same family.