Password Strength Checker Online

If you're not sure whether a password is strong enough, this tool gives you an honest assessment — estimating how long it would take to brute-force, what character classes it's missing, and whether it's a commonly used weak password.

How it works

The checker runs entirely in your browser. It calculates the password's entropy by analysing its length and the size of the character pool used (lowercase, uppercase, numbers, symbols). It then estimates a brute-force crack time at a rate of 1 billion guesses per second (representative of modern GPU attacks on offline databases), and checks the input against a list of common weak passwords. Nothing you type is sent to a server.

How to use it

1. Type your password into the input field — the analysis updates in real time
2. Toggle the eye icon to show or hide the characters
3. Check the strength bar and the Security Checklist to see which criteria are met
4. Review the estimated brute-force crack time

A few things worth knowing

• Length matters most: A 14-character password of random lowercase letters is far stronger than an 8-character password with special characters. Entropy grows exponentially with length
• The crack time is for offline attacks: Online login forms have rate limits and account lockouts. The estimated time applies to scenarios like a leaked database being cracked offline — the most dangerous kind of attack
• Don't rely on one metric: A password that passes length and complexity checks can still be weak if it's based on a dictionary word with substitutions (like P@ssw0rd) — these patterns are well-known to attackers

FAQ

Is it safe to type my actual password here? Yes. The evaluation is done entirely in your browser's memory using JavaScript. Your password is never transmitted over the internet or stored anywhere.

What makes a password actually strong? Length and randomness. A password manager-generated string of 16+ random characters is essentially uncrackable with current hardware. Passphrases (four or more random words strung together) are also strong and easier to remember.

What's the difference between a brute-force and a dictionary attack? Brute-force tries every possible character combination. Dictionary attacks use lists of common words, names, and known passwords. Both are used in practice; this tool's analysis considers both.

Related Tools

• Password Generator
• AES Encrypt