Password Strength Checker
Test how strong your password is — get a strength rating, entropy and an estimated crack time. 100% private.
Was this tool helpful?
Thanks for the feedback!
Type a password and press Check strength to get a rating from Very weak to Very strong, the password's length, its entropy in bits and an estimated time to crack it by brute force, plus specific suggestions such as "add symbols". Use it to compare candidate passwords before you set one, and to understand why length matters more than cleverness.
How the rating is scored
The checker gives one point for each of these, up to six:
- 8 or more characters, a second point at 12 or more, and a third at 16 or more
- both upper-case and lower-case letters
- at least one digit
- at least one symbol, meaning anything that is not a letter or digit, spaces included
The points map onto six labels, from Very weak at zero to Very strong at six. A password that begins with a very common choice such as password, 123456, qwerty, admin or welcome is capped at Weak whatever else it contains.
Entropy and crack time
Entropy estimates how many guesses a brute-force attack would need. The checker adds up the size of each character group you used (26 lower-case, 26 upper-case, 10 digits, 33 symbols) and multiplies the password length by log₂ of that pool. The crack time assumes an attacker tries 10 billion guesses a second and succeeds, on average, after trying half of all combinations.
| Password | Rating | Entropy, crack time |
|---|---|---|
| qwerty | Very weak | 28 bits, instantly |
| sunita1987 | Fair | 52 bits, 2 days |
| Sunita@1987 | Good | 72 bits, centuries |
| correct horse battery staple | Good | 165 bits, centuries |
| mango-Rickshaw-47-lamp | Very strong | 145 bits, centuries |
Notice that the long all-lower-case passphrase is rated only Good, because the rating rewards variety, yet its entropy is the highest in the table. For long passphrases, trust the entropy figure over the label.
Where the estimate is too generous
Real attackers do not start with random combinations. They try leaked passwords, dictionary words, names, dates and common substitutions first. Sunita@1987 scores "centuries" here, but a first name plus a birth year is among the earliest patterns a cracking tool attempts. Only a short list of very common passwords is recognised, so keyboard runs like 9876543210 still come out as Fair. A password reused on several sites is also only as safe as the weakest of those sites.
What actually makes a password strong
- Length first. Four or more unrelated random words beat a short string of symbols and are easier to type.
- Randomness. Nothing from your life: no names, birthdays, pet names or phone numbers.
- Uniqueness. A different password for every account, kept in a password manager.
- Two-factor authentication on email, banking and social accounts, so a leaked password alone is not enough.
NIST's digital identity guidelines (SP 800-63B) likewise put length and screening against known-breached passwords ahead of forced symbol-and-number rules. For a random password, try the password generator, then test it here. The check runs in your browser and the password is never transmitted.