Password Strength Checker
See how long a password would actually survive, and why.
Runs entirely in your browser — nothing you paste is sent to our servers.
What this tool does
Time, not a traffic light
The verdict is how long three different attackers would need, at stated guess rates, rather than an unexplained colour.
Pattern-aware
Dictionary words, leetspeak substitution, keyboard runs, sequences, repeats and year suffixes are detected and priced in.
Never transmitted
The estimate runs in this tab. There is no request to score against, so nothing you type can be logged, cached or breached.
Specific reasons
Every deduction is named, so you can see which part of the password is the weak part and change only that.
Frequently asked questions
Is my password sent anywhere?
No. The estimate is computed by JavaScript in this tab, and the page makes no request to score it — you can confirm that in your browser's network panel. Any password checker that scores server-side has your password in a request body, and by extension possibly in a log.
Why is "Password1!" rated so badly when it meets every complexity rule?
Because complexity rules describe the character set, not the difficulty. A capitalised dictionary word with a digit and a symbol appended is the single most predictable password shape there is, and cracking tools generate it directly from a wordlist. Meeting the rule and resisting an attack are different things.
Why does a long phrase of plain words score higher than a short jumble?
Because guess count grows exponentially with length and only linearly with alphabet size. Four unrelated words are far more work to guess than eight mixed characters, and they are also memorable — which matters, since an unmemorable password gets written down or reused.
What does "bits of entropy" mean?
It is the base-2 logarithm of the estimated number of guesses. Each additional bit doubles the work, so 60 bits is roughly a billion times harder than 30. It compresses a very large number into one comparable figure.
Why do the three crack times differ so much for the same password?
They assume different password storage. A rate-limited login allows a few guesses per second; a fast hash like SHA-256 or MD5 lets a GPU cluster try tens of billions per second; a deliberately slow hash like bcrypt or Argon2 caps that at thousands. The same password can be safe in one and broken in another, which is why the site's hashing choice matters as much as yours.
Can this tell me if my password has been in a breach?
No, and that is a deliberate limitation. Checking against a breach corpus means either downloading an enormous wordlist or sending a hash prefix to a service — the second is how Have I Been Pwned's Pwned Passwords API works, and it is a reasonable thing to use, but it is a network request. This tool makes none, so it detects patterns rather than membership of a leaked list.
What actually makes a good password?
Length first, unpredictability second, uniqueness always. In practice: let a password manager generate a long random string per site, and use a long passphrase for the few you must type from memory. Reuse is the failure mode that matters most — one breach elsewhere becomes a break-in everywhere.
Should I change passwords regularly?
Not on a schedule, no. Forced rotation makes people pick weaker, more predictable variants — Summer2024! becomes Autumn2024!. NIST dropped the recommendation for this reason. Change a password when there is evidence it may be compromised, and put the effort into length, uniqueness and multi-factor authentication instead.
Monitor it, don't just check it
One-off checks catch what is broken today. CertNotify watches your certificates, domains, DNS and code continuously and tells you before something breaks.