Skip to content
ToolBoxGeniehome

Password Strength Checker

Developer Tools · Added

Most strength meters multiply length by the size of the character set and stop there. By that arithmetic Password123! scores 79 bits, and it is one of the first thousand strings any attacker tries. This shows both numbers — the naive one and one adjusted for the structure it can actually find — because the gap between them is what a meter is hiding. Use an example rather than a password you rely on.

Do not type a password you actually use.

Type one character different, or use an example below. This page runs entirely in your browser and sends nothing anywhere — but you cannot verify that claim on any site by reading it, including this one, and the habit of typing real passwords into web forms is worth not having.

Nothing is transmitted, stored or logged. Close the tab and it is gone.

Try an example instead

How to use the password strength checker

  1. 1Press one of the examples, or type a password you do not use anywhere.
  2. 2Read the adjusted strength and the naive figure beside it.
  3. 3Work down the patterns found — each says what it costs and why.
  4. 4Compare the two time-to-guess columns to see what the structure is worth to an attacker.

Examples

The shape a complexity rule produces

Input
Password123!
Result
79 naive bits, 67 once the sequence, the leading capital and the trailing symbol are charged for

Still an overestimate: with no dictionary, the worst thing about it — that it is a word — is invisible here, and the page says so.

A keyboard walk in disguise

Input
Qwerty!2345
Result
72 naive bits, 36 adjusted — a keyboard walk, a digit sequence, trailing digits and a leading capital

Eleven characters and four character classes, and half its apparent strength is structure.

Length beats character classes

Input
correct horse battery staple
Result
133 bits with no deductions at all — lower-case letters and a space, and stronger than both above put together

About the password strength checker

Why meters mislead

A strength meter has to produce a number from a string, and the only thing it can measure directly is the alphabet the string draws from. So it computes length times the log of that alphabet and calls it entropy. The arithmetic is correct and the label is wrong: entropy is a property of the process that generated something, not of the thing itself. A coin that landed heads eleven times has the same eleven bits as any other sequence; a password a person chose because it was memorable does not.

This matters because the attacker is not enumerating the alphabet. They start with leaked password lists, then dictionaries, then dictionaries with the transformations people apply — capitalise the first letter, replace o with 0, append a year, add an exclamation mark. A password assembled from those moves is found early in that process no matter how many character classes it satisfies, and a meter that scores it on character classes will tell you it is excellent right up until it is in a breach dump.

What the complexity rules did

Rules demanding an upper case letter, a digit and a symbol were meant to enlarge the search space. What they actually did was standardise it. Told to include a capital, people capitalise the first letter. Told to include a digit, they append one or a year. Told to include a symbol, they add ! at the end. The rule intended to add about 20 bits adds perhaps 6, because the attacker knows where to look.

This is why NIST's current digital identity guidance dropped composition rules and periodic forced expiry, and asks for length plus a check against known-breached passwords instead. Both changes point the same way: what matters is whether the password is already on a list somebody has, not whether it satisfies a pattern of character classes.

The number that is not about your password

Time-to-guess figures are quoted as though they were a property of the password. They are mostly a property of how the site stores it. The same string is uncrackable against a throttled login, awkward against an unthrottled one, and gone in an afternoon against a leaked database of MD5 hashes.

That is the argument for a slow hash. bcrypt, scrypt and Argon2 are designed to take a measurable fraction of a second and to resist being parallelised across GPUs, which turns a trillion guesses a second into a few thousand. Nothing a user does to their password moves the number as far as that choice does — which is worth remembering when a site's meter is lecturing you about symbols.

Frequently asked questions

Is it safe to type a password into this page?
The analysis runs in your browser: nothing is sent anywhere, stored, or logged, and closing the tab ends it. But you cannot verify that claim on any website by reading it, including this one, and the habit of typing real passwords into web forms is worth not having. Change a character, or use one of the examples — the structure is what is being measured, and a near-identical password has the same structure.
Why are there two entropy numbers?
The naive figure is length times the log of the character set, which is what most meters show. It answers the question “how hard would this be to guess if it had been generated at random from those characters” — and a password a human chose was not. The adjusted figure charges for the patterns found: sequences, repeats, keyboard walks, years, digits appended to satisfy a rule. The gap between the two is roughly what an attacker who models human habits gains.
Why do the crack times differ so wildly?
Because the speed depends on the site storing the password, not on the password. A throttled login allows perhaps a hundred guesses a second. An unthrottled one allows millions. A leaked database of fast hashes allows a trillion a second on rented GPUs — which is why bcrypt, scrypt and Argon2 exist: they are deliberately slow, and against them the same attacker manages thousands rather than trillions.
It says no patterns found. Is my password strong?
Not necessarily, and this is the honest limit of the page. There is no dictionary here — a real estimator matches against word lists, name lists and leaked-password corpora, which is megabytes of data nobody should download to check one string. A common word, a name, a football team or a password from a past breach has no structure this page can see and would still fall in seconds. Absence of a finding is not evidence of strength.
What actually makes a password strong?
Length, randomness, and not reusing it. Every character added multiplies the search space, while adding a symbol multiplies it once — which is why a long passphrase of ordinary words beats a short string of punctuation. The honest answer, though, is that nobody should be choosing passwords by hand: a password manager generates a random one per site, and then the only password worth thinking about is the one protecting the manager.

Related tools