Password Strength Checker
Type a password and the page pulls it apart the way cracking software would — words, years, keyboard runs — and charges each piece what it is actually worth. The field is masked by default, and the analysis is masked with it. Nothing you type leaves the tab; the page makes no network requests at all.
How long it would hold
What a cracker sees
Checks
What "strength" is actually measuring
A password is not strong or weak by itself. It is strong or weak relative to the order in which someone guesses. Attackers do not start at aaaaaaaa and count upwards — they start with the passwords real people have already used, run those through rules that add a digit, capitalise the first letter, swap e for 3, and only fall back to brute force when the cheap tricks are exhausted.
Entropy in bits is the way to put a number on that. One bit means two possibilities, ten bits about a thousand, twenty bits about a million, and every extra bit doubles the work. Against the worst realistic case — a stolen password file that the site hashed badly — 40 bits gives you up in under a second, 60 bits lasts about a week, and 80 bits holds for something like nineteen thousand years. That is the whole scale, and it is steeper than it feels.
How this page estimates it
The password is chopped into the longest recognisable pieces, and each piece is charged what it would cost an attacker to reach it. A dictionary word costs about 14 bits, which is what running a 20,000-word list implies. A year costs about 7 bits, because there are only around 150 plausible ones. A keyboard run costs almost nothing. Characters belonging to no pattern are charged the full price for the character set in use.
Take Garden2019!. Eleven characters drawn from a 95-character set works out at 72 bits if you multiply it out, which sounds excellent. Priced the way an attacker would: a word (14 bits), one bit for the capital, a year (7 bits) and a single unpredictable symbol (7 bits). Twenty-nine in total. Type it in above and that is what you get — under an hour against a properly hashed leak, instant against a badly hashed one. That gap is the entire point of this tool. Length only helps when the length is unpredictable.
Why the number is a ceiling, not a promise
- The word list here is tiny. A real cracking dictionary holds millions of entries pulled from leaked databases, song lyrics, place names and every language that fits on a disk. Anything this page has not heard of is charged full price: swap Garden for Fluffy in the example above and the score leaps from 29 bits to 53, purely out of ignorance. The real figure is usually lower than the one shown.
- It knows nothing about you. Your dog's name, your street, your child's birth year and your team all look like random strings to it, and like the first guesses to anyone targeting you personally.
- It reads left to right, longest match first. That is fast and close enough, but a cleverer description of your password may exist that this scan does not find.
- It cannot tell you if the password has leaked. Checking that means asking a breach database, which means a network request. This page makes none, deliberately. It is a genuine hole: a password can be flagged Very strong here and still be sitting in a public dump because you used it on a site that got hacked.
What the crack times assume
Three attackers are shown, and the spread between them is wider than any password decision you will make. Guessing at a live login page that locks accounts is hopeless for the attacker — roughly 350 tries an hour. A stolen password file that was hashed with bcrypt costs about 100,000 guesses a second. The same file hashed with MD5 costs a trillion a second on rented gaming hardware. Same password, ten million times the difference, decided entirely by a choice the website made and never told you about.
The figures assume the attacker finds your password halfway through the search, which is the average case, and they are rounded to an order of magnitude on purpose. Treat them as "seconds, days or centuries", not as a countdown.
What actually protects an account
Since 2017 the US standards body NIST has recommended the opposite of what most password rules still enforce: set a minimum of 8 characters, allow at least 64, accept any character including spaces, screen new passwords against lists of breached ones, and stop forcing composition rules and scheduled expiry. Those rules were shown to push people into predictable behaviour — Password1! becoming Password2! every ninety days.
The practical version is short. Make it long rather than clever; four or five random words beat a mangled one every time. Never use the same password twice, because the most common way accounts fall is credential stuffing — a password leaked from a forum in 2019 tried against your email today. Use a password manager, since remembering unique passwords is the part humans genuinely cannot do. And turn on two-factor authentication, which is worth more than every bit of entropy on this page, because it is the only thing that helps when you type your perfect password into a convincing fake login form.
Frequently asked questions
Is it safe to type my real password into this page?
Technically yes: the analysis runs in your tab, the page makes no network requests, and nothing is stored. The wider habit is still worth keeping — never type a real password into a site you cannot verify. If in doubt, test a password with the same shape and length instead.
Why does my long password score badly?
Because length only counts when it is unpredictable. A word, a year and an exclamation mark comes to eleven characters and under 30 bits, since the attacker guesses words and years rather than characters. The breakdown shows exactly which pieces cost nothing.
Does this check whether my password has been in a data breach?
No. That requires querying a breach database over the network, and this page deliberately makes no requests. It is the main thing the tool cannot tell you, and a strong score here says nothing about whether the password has already leaked.
How long should a password be?
Twelve characters is the floor for anything that matters, sixteen or more for email and banking, and for a passphrase aim for four or five genuinely random words. Length is the only property that raises the attacker’s cost no matter which tricks they use.
Do symbols and capital letters matter?
Less than people think. Adding a symbol to a 20-character password raises its entropy by a few per cent; adding four more characters raises it far more, and you can actually type it. Symbols help most when they break a recognisable word apart rather than sitting at the end.
Last updated September 19, 2026