Password Strength Checker & Tester
Test your password strength in seconds. This password checker scores length and complexity, calculates the entropy, estimates the crack time for four attack scenarios — from a rate-limited login form to a GPU rig against a leaked hash — and shows exactly what to change to make it a strong password. It is a password tester you can use with a real password, because it never leaves your browser. Need a stronger one? Create it with the secure password generator (see also our privacy policy).
Runs in your browser — nothing is uploaded.Your password is checked on your device and never stored or sent.
Type a password above to check its strength
How to test your password strength
- Type or paste the password into the box above. Use the eye icon to show it if you want to check for typos.
- Read the strength score (Weak → Very Strong), the entropy in bits and the estimated crack time for each attack scenario.
- Go through the complexity checklist: every unchecked item is a concrete way to make the password stronger. Length gives the biggest gain.
- Ask yourself whether the password is random. If it is a word, a name, a date or a keyboard pattern, it is weaker than the number says (see the examples below).
How this password checker estimates strength
There are two ways to measure password strength, and it matters which one a checker uses.
Entropy-based (what this tool does)
The crack time comes from the brute-force formula entropy = length × log₂(charset). The charset is built from the groups present: 26 for lowercase, 26 for uppercase, 10 for digits and 32 for anything else (symbols, spaces, accented letters). P@ssword1 uses all four groups, so it scores 9 × log₂(94) ≈ 59 bits. The average crack time is half the search space divided by the guess rate: 2bits ÷ 2 ÷ guesses per second. The headline figure assumes 10 billion guesses per second.
The Weak → Very Strong label is a separate 0–8 point score: one point each for reaching 8, 12, 16 and 24 characters, and one point each for lowercase, uppercase, digits and symbols. 0–2 points is Weak, 3–4 Fair, 5 Good, 6 Strong and 7–8 Very Strong.
Pattern-based (zxcvbn and similar)
Pattern-based estimators such as Dropbox's open-source zxcvbn try to guess the password the way a cracker would: they look it up in lists of common passwords, names and English words, detect keyboard walks (qwerty), sequences (abc, 123), repeats, dates and l33t substitutions, and estimate how many guesses the cheapest combination of those patterns needs. That catches P@ssword1; a pure entropy model does not.
This checker does not ship a wordlist or a pattern matcher, so it cannot tell a random string from a disguised dictionary word. Its numbers are exact for passwords produced by a generator and an upper bound for anything a person invented.
How long does it take to crack a password? Crack time by attack scenario
Average time to find a randomly generated password by exhaustive search. The guess rates are orders of magnitude, not benchmarks of a particular machine:
- Online, rate-limited (10 guesses/s) — guessing through a login form that throttles requests. Lockouts and CAPTCHAs usually make it much slower.
- Offline, slow hash (10⁴ guesses/s) — a stolen database hashed with bcrypt at cost factor 10, attacked with one high-end GPU. scrypt and Argon2 tuned for login use land in the same range or lower.
- Offline, fast hash (10¹⁰ guesses/s) — the same GPU against unsalted MD5, SHA-1 or NTLM. Current consumer GPUs run tens of billions of MD5 guesses per second. This is the figure the tool shows first.
- Offline, multi-GPU rig (10¹² guesses/s) — dozens of GPUs, or rented cloud capacity, against a fast hash.
| Password | Bits | Online login, rate-limited | Offline, slow hash (bcrypt) | Offline, fast hash (MD5, SHA-1, NTLM) | Offline, fast hash, multi-GPU rig |
|---|---|---|---|---|---|
| One of the 10,000 most common passwords | 13.3 | 8 minutes | less than a second | less than a second | less than a second |
| 8 random lowercase letters | 37.6 | 330 years | 4 months | 10 seconds | less than a second |
| 8 random characters, all four groups | 52.4 | 9.7 million years | 9,700 years | 4 days | 51 minutes |
| 4 random words (7,776-word Diceware list) | 51.7 | 5.8 million years | 5,800 years | 2 days | 30 minutes |
| 12 random characters, all four groups | 78.7 | over a trillion years | 750 billion years | 750,000 years | 7,500 years |
| 16 random lowercase letters | 75.2 | over a trillion years | 69 billion years | 69,000 years | 690 years |
| 6 random words (Diceware) | 77.5 | over a trillion years | 350 billion years | 350,000 years | 3,500 years |
| 16 random characters, all four groups | 104.9 | over a trillion years | over a trillion years | over a trillion years | 590 billion years |
Three things stand out:
- Online attacks only beat common passwords. Even 8 random lowercase letters survive centuries behind a rate-limited login. What succeeds online is trying the most common passwords, and credential stuffing — replaying email/password pairs leaked from another site.
- Storage matters as much as the password. The same 8-character password lasts days against MD5 and thousands of years against bcrypt. If you build the login, hash with Argon2id, scrypt or bcrypt — never a plain or fast hash (the hash generator is for checksums, not password storage).
- Length is the lever you control. Going from 8 to 12 random characters multiplies the work by about 944 ≈ 78 million; adding symbols to an 8-character lowercase password gains far less.
Worked examples: score vs. real-world strength
These are the exact results this tool gives, next to how an attacker would actually see each password:
| Password | Bits | Crack time shown | Score | Reality |
|---|---|---|---|---|
| password | 37.6 | 10 seconds | Weak | Top of every wordlist — cracked instantly in practice. |
| qwerty123 | 46.5 | 1 hour | Fair | Keyboard walk + digits. Wordlists contain it; real time is near zero. |
| P@ssword1 | 59.0 | 11 months | Good | Passes every complexity rule, but Hashcat rules guess it in seconds. |
| Summer2026! | 72.1 | 8,000 years | Good | Season + year + ! is a classic pattern. Far weaker than the estimate. |
| correct horse battery staple | 164.0 | over a trillion years | Strong | Four common words. Good if the words were picked at random (≈44 bits from a 2,048-word list), not if it's a famous phrase — this one is. |
| k7#Qv9!mZ2pL$x4R | 104.9 | over a trillion years | Very Strong | 16 random characters from a generator. The estimate is accurate here. |
The pattern is clear: the only password whose estimate you can trust is the one a generator produced. If you need a new one, the password generator creates it with crypto.getRandomValues, also in your browser.
What NIST SP 800-63B says about strong passwords
NIST Special Publication 800-63B (revision 4, 2025) is the US federal guideline most security policies now follow. Its password rules reverse a lot of older advice:
- Length over complexity. At least 15 characters when the password is the only factor, 8 when it is combined with multi-factor authentication. Services should accept at least 64 characters.
- No composition rules. Services should not require a mix of uppercase, digits and symbols — those rules produce
Password1!, not strong passwords. - No forced rotation. Passwords should not expire on a schedule; change them only when there is evidence of compromise.
- Screen against a blocklist. New passwords must be checked against known-breached passwords, dictionary words, repetitive or sequential strings (
aaaaaa,123456) and context-specific words such as the service or user name. - Allow every character and password managers. Spaces and Unicode should be accepted, and pasting should not be blocked.
- Limit failed attempts so online guessing stays in the slow first column of the table above.
This checker covers the first point (length) and shows the complexity checklist for policies that still require it. It does not do the blocklist screening — use a breach check such as Have I Been Pwned's Pwned Passwords for that.
Common weak password patterns
Cracking tools try these early, so they are far weaker than their length and character mix suggest:
- Predictable substitutions —
a→@,o→0,e→3,s→$. Cracking rules apply them automatically. - Word + year + "!" to meet a policy.
Name2026!is a template, not a password. - Keyboard walks like
qwerty,1q2w3eorasdfgh. - Sequences and repeats —
123456,abcdef,aaaaaa. - Personal details — names, pets, birthdays, teams, the site's own name. Attackers build targeted wordlists from social profiles.
- Incrementing an old password —
Password1→Password2after a forced reset. - Reusing a password. One breach anywhere and attackers try the same email and password on other sites (credential stuffing). Strength doesn't help if it is already leaked.
- Passphrases from famous phrases — song lyrics, quotes, or the xkcd example above. A passphrase is only strong if the words are picked at random.
Why a password tester must run client-side
Typing a password into a website that sends it to a server is the same as handing it over. Even with good intentions, request bodies end up in access logs, error trackers and session-replay tools. This is not hypothetical: in 2025 researchers found that JSONFormatter and CodeBeautify had kept more than 80,000 pasted snippets (about 5 GB) on their servers, and they contained real passwords, API keys and Active Directory credentials. Read how that leak happened.
This password strength test has no backend to receive anything: the score, entropy and every crack-time figure are computed by JavaScript in this tab, and the password is not written to storage. To check that for any tool: open DevTools → Network, type a test value, and confirm no request goes out — or load the page, switch off Wi-Fi, and see that it still works.
Learn more
Why You Should Never Paste Sensitive Data Into Online Tools
API keys, JWT tokens, database URLs, passwords — pasting them into server-side tools is a real security risk. Learn what happens to your data and what client-side alternatives to use.
.env Files and Environment Variables Explained
Environment variables and .env files are how modern applications manage configuration across environments. Learn how they work, how to use dotenv, and how to keep secrets out of your codebase.
Regex Cheat Sheet for JavaScript Developers
Anchors, quantifiers, character classes, flags, named groups, lookaheads, and copy-paste patterns for email, URL, date, and more — with JavaScript method examples.
Related Tools
Frequently Asked Questions
Is it safe to test my real password in an online password checker?▾
Only if the checker runs entirely in your browser. This one does: the strength score and crack-time estimates are calculated with JavaScript on your device, and no network request carries your password. You can verify it yourself — open DevTools → Network, clear the log, then type a password. Nothing is sent.
A server-side password tester receives your password in plain text, and from then on it can end up in request logs, analytics or a database. If you are unsure about a tool, test a password that is similar in shape (same length and character types) instead of the real one.
How does this password strength checker work?▾
It does two independent calculations. The strength label (Weak → Very Strong) is a 0–8 point score: one point each for reaching 8, 12, 16 and 24 characters, and one point each for containing lowercase, uppercase, digits and symbols. The crack time comes from brute-force entropy, length × log₂(charset), where the charset is 26 for lowercase, 26 for uppercase, 10 for digits and 32 for symbols — so 16 random characters from all four groups give about 105 bits.
It does not compare your password with dictionaries or leaked-password lists. Pattern-based estimators such as zxcvbn do, which is why they rate P@ssword1 as trivially guessable while a pure entropy model does not. Read the estimate as an upper bound.
What makes a strong password?▾
Length and unpredictability. A strong password is long (15+ characters), randomly generated or a passphrase of several random words, unique to one site, and not built from a dictionary word with obvious substitutions. In practice the easiest way to get one is a password manager or a password generator, and the second-best protection is turning on two-factor authentication so a stolen password alone is not enough.
What does a password complexity checker check, and is complexity the same as strength?▾
A password complexity checker tests composition rules: minimum length and whether the password contains uppercase, lowercase, digits and symbols. Strength is how many guesses an attacker needs. They are related but not the same: P@ssword1 meets every complexity rule and is still one of the first guesses in any cracking wordlist, while a 20-character lowercase passphrase of random words has no symbols and is far stronger. This page shows both — the complexity checklist and an entropy-based crack-time estimate. NIST now advises services not to impose composition rules at all.
How long would it take to crack my password?▾
It depends far more on how the password is stored than on the attacker. For a random 12-character password using all four character groups (about 79 bits): never through a rate-limited login form, hundreds of billions of years against bcrypt on one GPU, and hundreds of thousands of years against an unsalted fast hash like MD5. A random 8-character password drops to days against a fast hash. Any password that is a common word or appears in a breach list falls in seconds in every offline scenario, whatever its length. Type yours above to see all four scenarios.
Why can P@ssword1 look strong to a checker but still be cracked in seconds?▾
Character-set entropy assumes every character was chosen at random. P@ssword1 was not: it is a dictionary word with a predictable a→@ substitution and a trailing digit. Cracking tools such as Hashcat apply exactly these rules to wordlists, so P@ssword1 falls in seconds even though the brute-force estimate here says about 11 months. Treat the crack time as an upper bound that is only accurate for randomly generated passwords, and use the checklist plus common sense for human-chosen ones.
What is the difference between an online attack and an offline attack?▾
An online attack guesses through a live login form, which usually enforces rate limiting, lockouts or CAPTCHAs — a handful of guesses per second at most, and often only a few dozen per account before lockout. An offline attack happens after an attacker steals a database of password hashes and runs cracking software on their own hardware with no throttling: around ten billion guesses per second per GPU against fast hashes like MD5 or SHA-1, but only thousands per second against bcrypt, scrypt or Argon2. The headline crack time here uses the fast-hash offline case because that is where password strength decides the outcome.
Is this a password cracker test — does it try to crack my password?▾
No. Nothing is guessed or hashed; the crack times are calculated from a formula. A real cracking test — running Hashcat or John the Ripper with wordlists and mangling rules against a hash — is what exposes human patterns like Summer2026!, and it is the reason the estimates here are an upper bound for invented passwords. Only run a cracker against hashes you own or are authorised to audit.
How long should a password be?▾
At least 15 characters for any password that protects an account on its own, and 8 at the absolute minimum when it is combined with a second factor — these are the figures in NIST SP 800-63B revision 4. NIST also tells services to stop forcing composition rules and periodic resets, and to check new passwords against lists of known-compromised ones instead. Length beats complexity: each extra random lowercase character adds about 4.7 bits, while switching from lowercase to full ASCII adds under 2 bits per character.
Should I change my password regularly?▾
Not on a schedule. NIST SP 800-63B says services should not force periodic password changes, because people respond with predictable increments (Spring2026! → Summer2026!). Change a password when there is evidence it was compromised: it appears in a breach, you reused it on a site that was breached, or you typed it into a phishing page.
Does this checker tell me if my password was leaked in a data breach?▾
No. It measures strength, not exposure — a strong password that was leaked is still compromised. To check exposure, use Have I Been Pwned's Pwned Passwords service, which uses k-anonymity: only the first 5 characters of the password's SHA-1 hash are sent, never the password itself. Many password managers run this check for you automatically.
Is my password sent to a server when I use this strength checker?▾
No. Everything runs in your browser using JavaScript — no network request is made with your password, and it is not stored in localStorage either. Reload the page and it is gone. You can confirm this in DevTools → Network: no requests fire while you type.