Password Strength Checker – Test How Strong Your Password Really Is

What does this Password Strength Checker do?

This free online password strength checker analyses any password and tells you how strong it is — instantly and without any signup. Along with a strength score from 0 to 4, you get the entropy in bits, an estimated crack time, character set analysis, and a detailed security checklist showing exactly which criteria your password meets or fails.

The tool works in real time: every character you type updates the analysis. It uses a combination of pattern detection, entropy calculation, and common-password screening to give you a realistic strength estimate — not just a simple length counter.

Because everything runs locally in your browser using JavaScript, your password never leaves your device. There's no server upload, no logging, and no rate limit. You can test as many passwords as you want, and close the tab when you're done.

How password strength is calculated

This tool doesn't just look at length and character types. It uses a multi-layer approach inspired by the zxcvbn estimator from Dropbox, which evaluates passwords the way real attackers crack them.[reference:0]

1. Entropy calculation

Entropy measures the randomness of a password in bits. The theoretical formula is:

Entropy = length × log₂(character set size)

For example, an 8-character password using only lowercase letters (26 possible characters) has an entropy of 8 × log₂(26) ≈ 37.6 bits.[reference:1] A random 8-character password using the full 94 printable ASCII characters has about 52 bits of entropy.[reference:2]

This tool applies a conservative adjustment: if your password contains common patterns or dictionary words, the effective entropy is reduced. This prevents overestimating the strength of passwords like P@ssw0rd123, which look complex but are easily cracked.

2. Pattern detection

The tool detects common weak patterns that attackers exploit:

• Repeated characters — aaa, 111, !!!
• Sequential characters — abc, 123, xyz
• Keyboard patterns — qwerty, asdf, zxcvbn[reference:3]
• Common words with predictable substitutions — p@ssw0rd, adm1n

3. Common password screening

The tool checks your password against a list of the most commonly used passwords — 123456, password, qwerty, admin, and others that appear in the top 100 breach lists.[reference:4] If your password matches any of these, it is flagged immediately.

4. Strength score (0–4)

The final score combines all signals:

How crack time is estimated

Crack time is estimated by dividing the number of possible guesses (2^entropy) by an assumed guessing rate. This tool uses 10 billion guesses per second, which represents a modern GPU attack against a fast hash like SHA-256.[reference:10]

It's important to understand what this means:

• Against SHA-256 or MD5 — a modern GPU can try around 10–180 billion combinations per second.[reference:11][reference:12] The crack time shown by this tool reflects this scenario.
• Against bcrypt — bcrypt is deliberately slow. A GPU can only try around 275,000 bcrypt hashes per second, roughly 50,000 times slower than SHA-256.[reference:13] If a service stores your password with bcrypt, the real crack time would be vastly longer.
• Against Argon2 — Argon2 is even slower and uses memory-hard design. The same GPU that tries 180 billion SHA-256 guesses per second drops to roughly 1,000 Argon2 guesses per second.[reference:14]

In other words: the crack time shown is a worst-case estimate assuming the service stores passwords with a fast hash. Good services use bcrypt or Argon2, which makes the real time much longer. But you should never rely on the service — use a strong password regardless.

What makes a password strong?

Password guidance has changed significantly in recent years. Both NIST and the UK's NCSC now recommend length over complexity — a longer password is better than a short password with symbols jammed in.[reference:15][reference:16]

Key recommendations

• Length first — NIST SP 800-63B-4 recommends a minimum of 15 characters for single-factor authentication.[reference:17] OWASP recommends at least 12 characters.[reference:18]
• Passphrases over passwords — Three or four random words strung together (e.g., correct horse battery staple) are both strong and memorable.[reference:19]
• No forced complexity — Requiring symbols, digits, and mixed case leads to predictable patterns like P@ssw0rd. Modern guidance advises against mandating these.[reference:20]
• Check against breach lists — NIST SP 800-63B explicitly requires checking passwords against lists of commonly-used and compromised passwords.[reference:21]
• No periodic rotation — Changing passwords every 90 days is no longer recommended unless there's evidence of compromise.[reference:22]
• Unique per service — Never reuse passwords across accounts. A password manager makes this practical.

What actually makes a password weak

• It's on a common-password list. 123456 has been the most common password in every major analysis since 2011.[reference:23]
• It's a single dictionary word, even with a symbol appended.
• It follows a predictable pattern (qwerty, abc123, password1).
• It's shorter than 12 characters.
• It contains personal information (names, birthdays, pet names).

What makes our tool unique?

Unlike other password checkers that send your password to a server, ours is 100% client-side. That means:

Frequently asked questions