Password strength checker
Check how strong a password is: estimated crack time, plus sequences, dates and common words flagged with tips. Runs in your browser, nothing is sent.
- Free
- No sign-up
- No file uploaded
- Windows, Mac, Android, iPhone
Your text stays on your device: nothing is sent.
Loading the tool…
Share this tool
About this tool
Type a password and the checker estimates its strength in bits, how long it would take to guess under three kinds of attack, and exactly what weakens it: number sequences, keyboard rows, dates, very common words or repeats. The check runs on your device; the password is never sent or saved.
When to use it
Check a password before you use it
Made up a passphrase or tweaked an old password? See whether it holds up against a dictionary attack before you use it on an important account.
Understand why a password is weak
"P@ssw0rd2024" looks complex, but it's just a common word, well-known substitutions and a year. The checker shows every pattern it finds.
Make the case to your team or family
Compare "qwerty123" with a four-word passphrase live: there's no better argument for a password manager.
How to use
- Type or paste the password into the field.
- Read the rating, estimated entropy and crack times.
- Fix the weak spots it lists.
- If needed, create a new password with the generator.
How it works
The password is split into pieces: very common passwords and words (including spellings with @, 0 or 3), years and dates, keyboard rows, runs like 1234 or abcd, and repeats. Each pattern only counts for a few bits because attackers try it first; the remaining characters count according to the size of the character set used.
Crack time assumes an attacker has to try half the possibilities on average: 100 guesses per second for an online attack, 10,000 for a stolen database protected by a slow hash, and 10 billion for a fast hash. These are orders of magnitude. The password stays in the page and is never sent or saved in the browser.
Tips for best results
- Length beats complexity: aim for at least 12 characters, 16 for important accounts.
- A passphrase of four or five unrelated words is strong and easy to remember.
- Never reuse a password across sites.
- Avoid birthdays, names and your pet's name, which are easy to find on social media.
- Turn on two-factor authentication for email and banking, even with a strong password.
Common problems and fixes
My password looks strong but gets a weak rating
It probably contains a common word, a year or a keyboard row. Cracking tools try those patterns first, whatever the total length.
A site rejects a password rated strong
Sites have their own rules, such as a maximum length or banned symbols. Adjust it, then check its strength again here.
I don't know whether my password has leaked
This tool doesn't check, because it would have to send part of the password's hash to an outside service. Your password manager or browser can run that check.
Frequently asked questions
Is my password sent anywhere?
No. The analysis is done by code running in your browser. The password is never transmitted or saved, and it's gone when you close the page.
How accurate is the estimate?
It's a guide. It catches the most common patterns, but it doesn't know your personal details or lists of passwords that have already leaked.
What does entropy in bits mean?
It measures how many guesses are needed: each extra bit doubles that number. Above 80 bits, a password is beyond the reach of known attacks.
Why three different crack times?
An online attacker is slowed down by the site. With a stolen database, speed depends on how well the site protected its passwords.
Do you check whether the password has been breached?
No, on purpose: that would mean sending part of its hash to a third party. Nothing leaves your device.
Related searches
Still stuck?
Ask on the forum: the category, the tool, your device sheet and the test result will be filled in for you.