Password Strength Checker
Use this free online Password Strength Checker to audit any password for length, character variety, common patterns and estimated brute-force crack time. It is useful for testing your existing accounts during a security review, verifying that your password manager's generated output is actually strong, teaching family members what makes a good password, or showing a colleague that 'Password123!' really is as bad as it looks. Type a candidate password and the tool returns an instant strength rating, a list of issues found, and concrete recommendations. The password never leaves your browser — there is no transmission, no logging, no recovery on our end. Replace any password that scores below Strong.
How Strength Is Calculated
This checker estimates entropy based on length and character variety, then reduces the score for common patterns (sequential numbers, repeated characters, dictionary words). The estimated time-to-crack assumes a fast offline attacker performing 10 billion guesses per second.
How to Use This Password Strength Checker
Checking a password is one keystroke at a time.
- Type the candidate password into the input field — the audit updates with every keystroke.
- Read the strength rating — Very Weak through Excellent.
- Review the list of issues found — common patterns, short length, missing character classes.
- Read the estimated crack time and the concrete recommendations.
- If the score is below Strong, replace the password using the Password Generator.
How This Password Strength Checker Works
Password strength is essentially a measure of entropy — how many guesses an attacker would need on average to crack the password by brute force. The checker computes a base entropy score from the character pool size and the password length: a 12-character password drawing from the full 95-character printable ASCII set has roughly 78 bits of entropy, which would take an offline cracker years even with modern GPU clusters. The checker then applies penalties for common weaknesses. Dictionary words and common substitutions (e.g. P@ssword, Welcome1) are matched against a list of the most-leaked passwords and heavily downweighted because attackers always try those first. Sequential patterns (1234, qwerty) and repeated characters (aaaa) are penalised because they appear frequently in real-world breaches. Personal-name and date-shaped sequences are flagged. The final score maps to a verbal rating from Very Weak to Excellent, plus a rough estimated crack time assuming a fast offline attack at 10 billion guesses per second. The whole audit runs locally in JavaScript, so the password you type never leaves the browser — that is essential for a tool that is asking you to type real credentials. Replace anything below Strong, and pair generation with a password manager.
Last updated: May 2026.
Frequently Asked Questions
What entropy is "strong enough"?
60+ bits is generally considered strong for online accounts. 80+ bits is overkill for most threats. Below 40 bits is weak and crackable in days.
Are common patterns really weak?
Yes. Cracking software tries dictionary words, l33tspeak substitutions ("p4ssw0rd"), and known sequences first. A password matching any of these patterns falls in seconds.
Does the tool send my password anywhere?
No — strength is calculated entirely in your browser. The password never leaves your tab.
Why is "Tr0ub4dor&3" rated only "Fair"?
It's short and uses a predictable pattern (capitalisation + leetspeak + digit + symbol). xkcd 936 explains why long passphrases ("correct horse battery staple") are stronger.
What's the safest password?
Long, random, and unique per site. A 16+ character password from a generator stored in a password manager is the practical gold standard.