Password Strength Checker
Check how strong a password is, with an entropy score, estimated crack time, and a breakdown of what makes it weak or strong — instantly inside your browser.
What makes a password strong?
Password strength comes down to how many guesses an attacker would need to find it — which depends on its length and how varied its character set is, not on whether it "looks" complicated. A long password made only of lowercase letters can still be weak if it's short or a common word, while a longer password mixing cases, numbers, and symbols is exponentially harder to guess.
This tool estimates a password's entropy in bits, flags it if it's one of the most commonly used passwords, and estimates how long it would take to crack under a fast offline brute-force attack — entirely inside your browser.
GuideHow to use it
How the strength score works
Entropy is calculated from the password's length and the size of the character pool it draws from — lowercase, uppercase, numbers, and symbols each add to that pool. More entropy means more possible combinations an attacker would have to try. The crack-time estimate assumes a fast offline attack capable of roughly 10 billion guesses per second, and any password matching a list of the most commonly used passwords is always flagged as weak regardless of its length.
Why it helpsFeatures & benefits
Why this runs entirely in your browser
Typing a real password into a web form is sensitive by nature, so this checker never sends what you type anywhere — the entropy calculation and every check run locally in JavaScript in the tab, and nothing is logged or stored.
Common uses
Checking a new password before using it on an important account, auditing an old password you're not sure is still safe, or understanding exactly why a password manager flagged a password as weak.
Frequently asked questions
A few things people usually want to know before trusting the numbers.
Entropy measures how many bits of randomness a password contains, based on its length and character variety. Higher entropy means exponentially more possible combinations to guess.
It's a rough estimate assuming a fast offline brute-force attack at roughly 10 billion guesses per second. Real-world crack times vary depending on the attacker's hardware and whether the password is reused or leaked elsewhere.
If it matches a commonly used password like "password1" or "qwerty123", it's flagged as weak regardless of length or entropy, since attackers try common passwords first.
Yes — everything runs locally in your browser and nothing is ever transmitted or stored, so it's safe to check real passwords here.
No. All analysis happens locally in your browser. Nothing typed here is sent to a server, stored, or shared.