Password Strength Checker

What this tool does

Strength here is estimated from the password's own characters: its length, which character classes it mixes, and whether it matches patterns that make real passwords weaker than their length suggests, such as a keyboard run, a repeated character or one of the passwords that show up constantly in breach data. The crack-time estimate assumes a determined offline attacker guessing billions of times a second against a stolen password database, which is a far higher bar than a website's login form, so treat it as a rough order of magnitude rather than a promise.

How to use it

1. Type a password into the field. It is never sent anywhere.
2. Read the strength score, character classes used and any warnings.
3. Adjust the password until the warnings clear and the estimate improves.

Privacy

This tool runs entirely in your browser. Your input is never uploaded, stored or shared — closing the tab removes it.

Frequently asked questions

Is my password sent to a server or logged anywhere?

No. Scoring happens entirely in JavaScript running in your browser. The password is never transmitted, stored or written to a request log.

How is the crack-time estimate calculated?

From the password's entropy in bits, assuming ten billion guesses per second, which is roughly what dedicated offline cracking hardware can attempt against a leaked password database. It is an order-of-magnitude estimate, not a guarantee.

Why did a long password still score as weak?

Length alone is not enough. Repeated characters, keyboard or alphabet runs, and passwords that appear in common breach lists are flagged and lower the score even when the character count looks fine.