What is a Password Strength Checker?
Password strength is usually described as entropy — the number of bits of uncertainty an attacker faces. A password chosen at random from 26 lowercase letters has about 4.7 bits per character, so an eight-character one carries roughly 38 bits and a sixteen-character one about 75. Every additional bit doubles the search space, which is why length dominates every other factor.
Entropy alone is not the whole answer, because people do not choose characters at random. They use dictionary words, capitalise the first letter, append a digit and swap some letters for lookalikes — and every one of those moves is in the first rule-set a cracking tool applies. So this checker starts from the theoretical maximum for the character set in use and subtracts a penalty for each pattern it finds: a common password inside the string, a keyboard run, a repeated block, a year.
The result is reported as a time, because bits are hard to picture. Four scenarios are shown, from a rate-limited login form taking ten guesses a second to a GPU rig running a billion a second against a weak hash. The last row is the important one: the same hardware falls back to about ten thousand guesses a second against bcrypt, scrypt or Argon2, which is why the hash your service stores matters as much as the password your user picks.
How to check a password's strength
- Type or paste the password. It stays in the page — there is no network call and no logging — but use a password you would not mind losing, and never a live one you use elsewhere.
- Read the entropy figure and the strength bar. Under 40 bits is weak, around 60 is reasonable, and 80 or more is strong against offline attack.
- Check the findings. A common password or a keyboard run matters far more than the character mix, because those are the first things tried.
- Read the crack-time table top to bottom. The first two rows are online attacks your service's rate limiting is meant to stop; the last two are about what happens after a database leak.
- If the password is short, lengthen it rather than adding symbols. Four unrelated words give around 50 bits and are far easier to remember than eight random characters.
Password Strength Checker limits and rules
| Item | Limit |
|---|---|
| Method | Theoretical entropy for the character set in use, minus a penalty for detected patterns |
| Character sets | Lowercase 26, uppercase 26, digits 10, symbols 33 |
| Patterns detected | Common passwords, keyboard runs, ascending and descending sequences, repeated blocks, four-digit years |
| Crack model | Average case — half the keyspace, which is how long a search takes on average |
| Scenarios | 10, 10,000, 10 billion and 10,000 guesses per second |
| Passphrase estimate | Word-based entropy is not modelled; the character-set figure understates a four-word passphrase |
| Breach check | Not performed — that would need a network call, which this tool deliberately never makes |
| Dictionary size | A short built-in list of the most common passwords, not a multi-million-entry corpus |
| Storage | Nothing is stored. Clear the field or close the tab and the value is gone |
| Not covered | Per-site password policy checks, password reuse detection and generation |
When to use it
- Checking whether a new password is actually strong before saving it, rather than relying on a policy that only counts character types.
- Understanding why a password that looks complex — P@ssw0rd1 — still falls in seconds, and what to change instead of adding another symbol.
- Deciding between a short complicated password and a longer passphrase, with the entropy figure to compare the two.
- Explaining to someone why the same password behaves differently on two sites, depending on which hashing algorithm each one uses.
- Sanity-checking a password you generate elsewhere, using the generator on this site, for example, to see the entropy it actually achieves.
Is it private?
Everything runs inside your browser. Your text and files are never uploaded, never stored and never seen by anyone else — including me. You can use the tool with the network tab open and watch no request leave the page. Closing the tab erases the input.
Frequently asked questions
The analysis runs in JavaScript in your own tab. There is no network request in the code path, nothing is written to storage, and the value disappears when the tab closes. That said, the safest habit is to test a variation of the password rather than the exact one you use, or to check it after rotating it.
Around 80 bits is the usual target for something that must resist an offline attack on a leaked database. Sixty is reasonable for a site with good rate limiting. Below 40 bits, a determined attacker with a single GPU will get there, and below 30 bits it is a matter of seconds.
Because length multiplies. Each lowercase character adds about 4.7 bits, so 17 random lowercase letters reach roughly 80 bits — the same as 12 characters from a larger set. The catch is the word 'random': an 17-letter dictionary phrase is not 80 bits, which is exactly what the pattern penalties are there to catch.
It helps by widening the per-character search space from 62 to 95, which adds about 0.6 bits per character. Adding two characters to the length adds around 9.4 bits. If you can only make one change, make the password longer — and if you can make both, do both.
Online attacks go through a login form and are limited by how many requests the service allows, which is why the top rows look generous. Offline attacks happen after a database is stolen, where the attacker has a copy of the hashes and no rate limit. A slow hashing algorithm is what keeps that fourth row low.
Related tools
Written and maintained by Md. Nur Hossain Repon.