Password Strength Checker

Find out how strong a password really is and how long it would take to crack — without sending it anywhere. The check runs entirely in your browser.

Checked entirely on your device. The password is never sent anywhere — you can even disconnect from the internet first.

Strength: –

Findings

    Estimated time to crack
    Attack scenarioEstimated time to crack

    How this password checker works

    The checker estimates entropy — the number of guesses, expressed in bits, that an attacker would need on average. It starts from the length and the character types you used, then applies penalties for weaknesses that cracking tools exploit:

    • Matches with the most common leaked passwords (including “leetspeak” versions like p@ssw0rd).
    • Keyboard sequences such as qwer, asdf or 1234.
    • Repeated characters (aaa, 111).
    • Years and dates (1987, 2026).
    • The classic pattern Capitalised word + digits + symbol (Football2026!).

    The result is then converted into estimated crack times for three realistic attack scenarios.

    Understanding the crack-time scenarios

    Attack scenarios used by the checker
    ScenarioSpeedWhen it applies
    Online attack100 guesses/secGuessing against a live login page that has some rate limiting.
    Offline, slow hash10,000 guesses/secA stolen database protected with bcrypt, scrypt or Argon2.
    Offline, fast hash100 billion guesses/secA stolen database using MD5, SHA-1 or NTLM, cracked on a GPU rig.

    You don’t control how a website stores your password, so aim for a password that survives the fast-hash scenario: at least 80 bits, or “centuries” in the last row.

    What the result means

    • Very weak / Weak (< 50 bits) — replace it now, especially if it is reused.
    • Fair (50–63 bits) — acceptable only with two-factor authentication.
    • Strong (64–79 bits) — good for most accounts.
    • Very strong (80+ bits) — resistant to offline attacks for the foreseeable future.

    Is it safe to type my real password here?

    This page sends nothing over the network: there is no form submission, no analytics and no third-party script, which is enforced by a strict Content Security Policy. Still, good practice is to test a password that is similar to yours rather than the exact one. And remember: no checker can tell whether your password has already appeared in a data breach without checking a breach database — if it has, it is weak regardless of the score.

    Improve a weak password

    Don’t patch it by adding a ! or changing a to @ — those tweaks are exactly what cracking rules try. Replace it with a randomly generated password or a 6-word passphrase.

    Last updated: · Reviewed by the Password Generator team

    Frequently asked questions

    How long would it take to crack my password?

    It depends on its entropy and on how the site stores it. Type it above to see estimates for online guessing, slow hashes like bcrypt and fast GPU cracking. A random 16-character password would take longer than the age of the universe even in the fastest scenario.

    Is this password checker safe?

    Yes. The analysis runs locally in JavaScript. The password is never transmitted or stored, and you can disconnect from the internet before testing.

    What is password entropy?

    Entropy measures unpredictability in bits. Each bit doubles the number of guesses needed. 40 bits means about a trillion possibilities; 80 bits means about a trillion trillion.

    Why does my “complex” password score low?

    Because it probably follows a common pattern, such as a word with substitutions and a year. Cracking tools try those patterns before random combinations, so the checker penalises them.

    Does the checker look up data breaches?

    No — to keep the check fully offline, it only compares against a built-in list of the most common passwords. A password that appeared in any breach should be changed regardless of its score.

    Related tools