Password Strength Checker
See how long a password would take to crack, and why.
About this password strength checker
Most strength meters just count character types and give you a green bar for adding an exclamation mark. That is close to useless, because attackers do not guess randomly — they run dictionaries, common substitutions and leaked password lists first.
This estimates entropy from the character set and length, then applies penalties for the patterns real cracking tools exploit: dictionary words, keyboard runs, repeated characters, dates, and leetspeak substitutions. The result is a rough time-to-crack against an offline attack, which is the scenario that matters when a company gets breached.
How to use it
- Type or paste a password. It never leaves your browser.
- Read the strength rating and the estimated crack time.
- Check the warnings — they name the specific weakness, not just a score.
- Lengthen rather than complicate. Length beats symbols every time.
Password Strength Checker — FAQ
Is my password sent anywhere?
No. Everything is calculated in your browser and nothing is stored or transmitted. That said, the safest habit is never to type a real password into any website — test something structurally similar instead.
Why does length matter more than symbols?
Each extra character multiplies the search space by the size of the alphabet. Adding one character to a 12-character password helps far more than swapping an a for an @, which attackers try automatically.
What makes a good password?
Sixteen characters or more, unique to that account, and stored in a password manager. A passphrase of four or five random words is easy to type and extremely strong.
What is an offline attack?
When attackers steal a database of password hashes and crack them on their own hardware, with no rate limiting. It is far faster than guessing at a login form, which is why the estimates here assume it.