Test how strong your password is instantly. Free in-browser password strength checker: 0-100 score, entropy, crack time and breach check.
This password strength checker tells you how strong your password really is: it scores it from 0 to 100, calculates its entropy in bits, estimates how long an attacker would need to crack it both online and offline, and—if you choose to run the optional check—tells you whether that exact password already appears in known data breaches. Every part of the strength analysis runs inside your browser using JavaScript. Nothing is uploaded, logged, or stored, so you can safely test a password you actually use.
Most people arrive at a password tester with one of three questions: “how strong is my password?”, “would a password cracker get this in an afternoon?”, or “does this meet the policy my employer enforces?” This tool answers all three on one page. The strength meter and requirements checklist answer the first, the crack-time and entropy panel answers the second, and the built-in password policy checker answers the third by letting you define a rule set and see exactly which rules a candidate password fails.
The score is a transparent 0–100 rating built from additive credits and penalties, not a black box. Length is weighted most heavily, because length is the single variable that grows the attacker’s search space exponentially.
| Factor | Effect on score |
|---|---|
| 12 or more characters | +30 |
| 10–11 characters | +25 |
| 8–9 characters | +20 |
| Under 8 characters | +2 per character only |
| Each character class present (upper, lower, digit, symbol) | +10 each |
| All four classes present | +10 bonus |
| Every character beyond 16 | +2 each, capped at +20 |
| Appears in the common-password list | −20 |
Sequential runs such as abc, 123, qwe | −10 |
| Three or more identical characters in a row | −10 |
Keyboard walks such as qwerty, asdfgh, zxcvbn | −10 |
The final total is clamped to the 0–100 range and mapped onto five labels: Weak under 26, Fair 26–50, Good 51–75, Strong 76–90, and Very Strong 91 and above. Alongside the meter you get a live requirements checklist and a plain-English suggestion list telling you precisely what to change—“add uppercase letters”, “avoid keyboard patterns”, and so on.
Entropy is the mathematically honest measure of password strength. It counts how many bits of information an attacker has to guess. The tool derives the character pool from the classes you actually used—26 for lowercase, 26 for uppercase, 10 for digits, 32 for symbols—and then computes entropy = log2(pool ^ length), which simplifies to length × log2(pool).
hunter22 — 8 characters, lowercase plus digits, pool 36. Entropy is 8 × 5.17 = 41.4 bits.Hunter22! — 9 characters, all four classes, pool 94. Entropy is 9 × 6.55 = 59 bits.correcthorsebatterystaple — 25 lowercase characters, pool 26. Entropy is 25 × 4.70 = 117.5 bits.That third example is the important one. It uses only lowercase letters and would fail most corporate complexity rules, yet it is roughly a billion billion times harder to brute force than the “complex” nine-character password above it. The tool grades entropy on a five-band scale: under 28 bits is very weak, 28–35 is weak, 36–59 is reasonable, 60–127 is strong, and 128 or more is very strong.
One caveat worth stating plainly: entropy calculated this way assumes the characters were chosen randomly. A password you invented yourself is a memorable pattern, not a random string, so a real attacker guessing with a dictionary or a rule-based mask will reach it far sooner than the raw bit count implies. That is exactly why the score subtracts points for sequences, repeats, and keyboard walks, and why the breach check below matters more than any arithmetic.
The password cracker test panel shows two very different numbers, because there are two very different attack scenarios. Both figures are average times, meaning the tool assumes an attacker finds the password after searching half of the keyspace.
| Scenario | Assumed rate | What it models |
|---|---|---|
| Online attack | 1,000 guesses per second | Credential stuffing or brute force against a live login endpoint, throttled by the network and by rate limiting |
| Offline attack | 158,000,000,000 guesses per second | An attacker who has stolen a password hash database and is cracking it locally on modern GPU hardware |
The offline figure is calibrated to a single high-end datacenter GPU running a fast, unsalted-style hash. It is deliberately pessimistic, and that is the point: it is the number that matters after a breach, when your password no longer has a rate limiter protecting it. A password that survives “centuries” online can fall in minutes offline. If your password shows a short offline time, treat it as already compromised the moment any site you use it on is breached.
Real-world defence also depends on how the site stores your password. A modern algorithm such as bcrypt, scrypt, or Argon2 is deliberately slow and cuts an attacker’s throughput by many orders of magnitude, while a raw MD5 or SHA-1 digest offers almost no resistance. You can see what different algorithms produce with our hash generator, and check whether a specific hash is already in public rainbow tables with the hash lookup tool.
Strength maths cannot tell you that a password has already leaked. Tr0ub4dor&3 scores well and has appeared in breach corpora for years. The optional breach check solves this by querying the Have I Been Pwned password database of over 700 million compromised passwords, using a privacy technique called k-anonymity:
The service never sees your password, and never even sees the full hash. This is the same mechanism used by 1Password, Firefox, and Microsoft Edge. If a match is found, the tool reports the exact number of times that password appeared in breach data. Any non-zero count means attackers already have it in their wordlists, and no amount of complexity scoring redeems it—change it.
Below the strength meter sits a configurable policy checker. Rather than assuming one universal standard, it lets you set the rules your organisation actually enforces and then reports pass or fail with a specific reason for each violated rule. Configurable options include minimum total length, whether uppercase, lowercase, numeric, and special characters are required, the minimum count of each of those classes, the maximum number of identical repeating characters allowed, and whether common passwords are blocked outright.
This is useful in two directions. If you are a user, it tells you in advance whether a password will be rejected by a signup form. If you are an administrator drafting an Active Directory fine-grained password policy or an application validation rule, it lets you sanity-test the rule set against realistic candidate passwords before you impose it on people.
NIST Special Publication 800-63B changed the official advice significantly, and much of the internet has not caught up. The current guidance recommends allowing passwords of at least 64 characters, accepting all printable ASCII and Unicode including spaces, and screening candidates against lists of known-breached and dictionary passwords. It recommends against mandatory composition rules that force a symbol and a digit, and against routine scheduled expiry, because both push users toward predictable transformations such as Summer2024! becoming Summer2025!.
The practical takeaway: length and uniqueness beat complexity. A four or five word passphrase is easier to remember and harder to crack than a mangled eight-character string. Generate one per account with our secure password generator, store them in a password manager, and enable multi-factor authentication wherever it is offered. More defensive utilities are listed on the security tools page.
Yes. Scoring, entropy, crack-time estimation, and policy checking all execute in your browser’s JavaScript engine. No password is transmitted, logged, or stored. The only network request the page can make is the optional breach check, and that sends five characters of a SHA-1 hash rather than the password itself.
A Strong rating means 76–90 points, which typically corresponds to 12 or more characters using several character classes with no detected patterns. That is adequate for ordinary accounts. For email, banking, and administrator credentials, aim for Very Strong plus at least 80 bits of entropy, and always pair it with multi-factor authentication.
Under 36 bits is guessable by consumer hardware. 36–59 bits is reasonable for low-value accounts. 60–127 bits resists offline GPU cracking for the foreseeable future. Above 128 bits is beyond brute force entirely, and the weak link becomes phishing, malware, or reuse rather than the password.
Because the two scenarios differ by a factor of about 158 million. A login form limits an attacker to roughly a thousand attempts per second, while an attacker holding a stolen hash file can run 158 billion per second on one GPU. The offline number is the one to plan around, since you cannot control which of your service providers gets breached.
No. There is no server-side component to the strength analysis, nothing is written to local storage, and refreshing the page discards everything.
It means that exact string appears in a public dump of compromised credentials, so it is already in attacker wordlists and will be one of the first guesses tried. Change it everywhere you have used it, never reuse it again, and enable two-factor authentication on the affected accounts.
For equal memorability, yes. A 25-character lowercase passphrase carries around 117 bits of entropy versus about 59 bits for a nine-character password using all four character classes. Length compounds; substituting @ for a does not, and crackers apply those substitution rules automatically.
Yes. The policy checker section lets you set minimum length, per-class minimum counts, a repeating-character limit, and common-password blocking, then shows exactly which rules a candidate password violates. It is a quick way to validate a proposed policy against realistic passwords before rolling it out.
So that no network request is ever made without your explicit consent. It also keeps the page fully functional offline and avoids sending hash prefixes for every keystroke while you are still typing.
Yes. It runs entirely client-side in any modern browser, including mobile Safari and Chrome, and requires no installation or account.
Weak passwords are the #1 cause of security breaches. This tool analyzes your password strength in real-time without sending it anywhere—all checking happens in your browser.
Use at least 16 characters, avoid personal information, and never reuse passwords across sites.
The National Institute of Standards and Technology (NIST) updated their password guidelines in Special Publication 800-63B. These recommendations have shifted the industry away from outdated practices.
✅ Length over complexity - Minimum 8 characters, but 15+ characters strongly preferred. Long passphrases like "correct-horse-battery-staple" are more secure than short complex passwords.
✅ Check against compromised passwords - Verify new passwords against databases of known breached passwords (like Have I Been Pwned).
✅ Allow all characters - Support spaces, emojis, and Unicode. Don't restrict character sets unnecessarily.
✅ Use password managers - Enable paste functionality so users can use password managers effectively.
❌ Forced rotation - Changing passwords every 90 days leads to weaker passwords. Only require changes after a breach.
❌ Composition rules - Requirements like "must contain uppercase, number, and symbol" don't improve security significantly.
❌ Password hints - Security questions and hints often weaken security.
❌ SMS-based 2FA - SIM swapping attacks make SMS codes vulnerable. Prefer authenticator apps or hardware keys.
| Factor | Impact |
|---|---|
| Length | Highest impact - exponentially increases attack time |
| Randomness | High impact - prevents dictionary attacks |
| Uniqueness | Critical - prevents credential stuffing |
| Breach status | Critical - known passwords are instantly cracked |
A 20-character passphrase with common words beats an 8-character complex password. Focus on length, uniqueness, and breach checking.
Strong passwords have: 16+ characters (longer = stronger), mix of uppercase, lowercase, numbers, symbols, no dictionary words or personal info, no patterns (123, abc), unique per account. Example: "Tr0pic@l-Sunset#47$Moon". Use passphrases: "Coffee!Mountain$River29". Entropy >60 bits ideal. Avoid: password123, qwerty, 12345678. Use password manager to generate and store unique passwords for every account.
Entropy measures password unpredictability in bits. Higher = stronger. Calculation: bits = log2(possible_combinations). Example: 8 lowercase letters = 37 bits (weak), 16 mixed characters = 95 bits (strong). 60+ bits = resistant to offline attacks, 80+ bits = excellent. Character variety matters: adding numbers/symbols increases entropy exponentially. Use entropy to compare password strength objectively.
Depends on: password length, character variety, attacker resources. Online attacks (slow): 1000 tries/sec - weak passwords cracked in seconds. Offline attacks (fast): 100 billion tries/sec (GPUs) - 8 char password cracked in hours. Quantum computers (future threat). Defense: 16+ character passwords take centuries to crack offline. Use multi-factor authentication (MFA) - even cracked password cannot access account alone.
Yes, but length matters more. Special characters increase entropy slightly. 16 character lowercase > 10 character with symbols. Best: combine both. Use special characters naturally: "Blue$Sky&Morning27" vs "p@ssw0rd" (weak despite symbols). Avoid predictable substitutions (@ for a, 0 for o). Focus on length first, variety second. Passphrases with spaces/punctuation are ideal.
Check using Have I Been Pwned (HIBP) Pwned Passwords database (850M+ breached passwords). HIBP uses k-anonymity - sends only first 5 hash characters, checks locally. Our tool integrates HIBP API. If found: change immediately, enable MFA, check for unauthorized access. Breached passwords are targeted in credential stuffing attacks. Never reuse passwords across accounts.
Yes. Password managers are safer than reusing weak passwords. They generate strong unique passwords, store encrypted (AES-256), sync across devices, auto-fill securely. Recommended: Bitwarden (open-source), 1Password, LastPass, Dashlane. Use strong master password + MFA. Risk: single point of failure if master password compromised. Benefit: eliminates password reuse, phishing-resistant, convenience. Essential security tool.
Common mistakes: using personal info (names, birthdays), dictionary words (password, admin), patterns (123456, qwerty), password reuse across accounts, short passwords (<12 chars), predictable substitutions (p@ssw0rd), writing passwords down insecurely, sharing passwords, no MFA. Attackers exploit these patterns. Solution: password manager + unique passwords + MFA for all accounts. Change default passwords immediately.
Change only when: confirmed breach, suspected compromise, sharing password (stop sharing), weak password needs upgrade. Do not change routinely (causes weaker passwords). NIST (2024) recommends: no mandatory periodic changes, change only after breach, use long unique passwords + MFA. Exception: rotate privileged access credentials (90 days). Focus on breach monitoring, not arbitrary schedules.