Password Strength Checker
See how strong a password really is. Type it in and this checker estimates its entropy in bits and roughly how long it would take to crack — all calculated locally, so nothing ever leaves your browser.
How to use the Password Strength Checker
Enter or paste any password you're considering.
The meter fills and colours by strength.
See entropy in bits and a rough crack time.
Add length and a mix of character types.
How password strength is really measured
The single biggest factor in password strength is length, followed by the variety of characters. We express strength as entropy in bits: the formula is length × log₂(pool size), where the pool is how many characters you drew from (26 lowercase, +26 uppercase, +10 digits, +~33 symbols). Each extra bit doubles the work for an attacker. A 6-character lowercase password is about 28 bits — crackable in seconds. Add length and mixing and the number climbs fast: a 12-character mix of all four types is around 78 bits, which is genuinely strong.
What this means in practice
Two lessons fall out of the maths. First, length beats complexity: a long passphrase of random words (see our passphrase generator) often scores higher than a short string of symbols, and it's far easier to remember. Second, entropy only counts if the password is genuinely random — "P@ssw0rd!" looks complex but is in every cracking dictionary, so its real strength is near zero. This checker rewards length and variety, but the safest path is to generate passwords randomly (try the password generator), store them in a password manager, never reuse them across sites, and switch on two-factor authentication. The crack-time figure here assumes a fast offline attack of about ten billion guesses a second; against a slow, well-hashed login the real time is far longer, but planning for the worst case keeps you safe.
Frequently asked questions
Is my password sent anywhere?
No — absolutely not. The calculation runs entirely in JavaScript in your browser. Nothing is transmitted, logged or stored. You can disconnect from the internet and it still works.
What does "bits of entropy" mean?
It's a measure of unpredictability. Each bit doubles the number of guesses an attacker needs. Around 28 bits is trivially weak; 60+ is reasonable for most accounts; 80+ is strong. The estimate assumes the worst case — that an attacker knows your character set.
How is crack time calculated?
It assumes a fast offline attacker making roughly ten billion guesses per second and, on average, needing half the keyspace. Real-world time varies hugely with how the password is hashed, so treat it as a relative guide.
Does it detect common passwords?
This tool scores by length and character variety, which is the core of entropy. It won't flag "Password123!" as a known-leaked password — for that, lean on length and genuine randomness, and never reuse passwords.