Password Strength Checker
Test how strong your password is with live entropy, pattern detection and crack-time estimates, plus tips to fix it. Free — it never leaves your device.
- No upload — 100% private
- Instant, on your device
- Free, no sign-up
- Works offline once loaded
How it works
How to use Password Strength Checker
Type or paste the password you want to test — it's analysed as you type, entirely on your device.
Read the strength rating, entropy in bits and the character types used.
Check the estimated crack times for online and offline attacks.
Follow the suggestions to fix weak spots, or generate a stronger password instead.
Why use it
Why use our Password Strength Checker tool
Realistic, pattern-aware scoring
Detects common passwords, dictionary words, l33t substitutions, sequences, repeats, keyboard walks, years and dates — not just character variety.
Crack-time estimates
Compares a rate-limited online attack with a GPU-powered offline attack on a stolen database, so you see the best and worst case.
Common password check
Matches against a built-in list of over a thousand of the most frequently leaked passwords, including look-alike spellings.
Actionable suggestions
Specific advice for your password, such as making it longer, moving the capital letter or dropping a predictable year.
Zero network traffic
The analysis runs in JavaScript in your browser. Your password is never sent anywhere, stored or logged.
FAQ
Frequently asked questions
Is it safe to type my real password here?
The check runs completely in your browser and nothing is transmitted — you can verify this by going offline after the page loads. Still, as a general habit, it's wise to test a similar password rather than the exact one protecting your most important account.
How is the crack time calculated?
We estimate how many guesses a smart attacker needs, taking patterns like dictionary words and dates into account, then divide by typical guessing speeds: about 100 per hour for a protected website and 10 billion per second for a stolen database with a fast hash.
Why does my complex-looking password score low?
Cracking tools don't guess randomly — they try common passwords, words with capitals at the start, symbols swapped for letters and years tacked on the end first. “P@ssw0rd2024!” looks complex but follows all of those patterns.
What is a good entropy score?
Below 40 bits is weak, 60 bits is reasonable for most online accounts, and 80 bits or more is strong enough to resist offline attacks on stolen password databases.
Does this check if my password was in a data breach?
It checks against a built-in list of the most common leaked passwords, but it doesn't query breach databases online — that would require sending data off your device. Use a dedicated breach-alert service for that.
Related tools
Password Generator
Strong random passwords and passphrases, made on your device.
Hash Generator
MD5, SHA-1, SHA-256, SHA-512 and HMAC for text or files.
JWT Decoder
Decode JWT header and payload, check expiry, verify HMAC.
Base64 Encode & Decode
Encode or decode Base64 text, files, images and data URIs.