This password strength checker estimates how many guesses an attacker would need, rather than counting character variety. Everything happens in your browser, and nothing you type is stored or transmitted.
Is it safe to type my password here?
Your password is analysed by JavaScript already loaded in the page. It is never sent to a server, written to storage, added to the URL, or included in an analytics event. Closing the tab removes it entirely.
How to verify it yourself
Do not take that on trust. Any password strength checker can claim it, and the claim costs nothing to make.
- Load this page, disconnect from the internet, then type. The checker keeps working.
- Open your browser's developer tools, switch to the Network panel, and type. No request appears.
- View the page source and read the code that scores what you typed.
A tool that sends your password somewhere cannot pass any of those three checks.
When you should not type your real password
If you have any doubt about a site, do not type a real password into it. That includes this password strength checker, and saying so costs us some usage.
You lose almost nothing by testing a stand-in: something the same length, with the same mix of characters and the same shape. A password strength checker scores structure, not meaning, so a look-alike gives you the same verdict.
How this password strength checker works
Why character-set maths gives the wrong answer
The obvious way to score a password is length × log₂(charset). By that formulaPassword1! is ten characters from a 95-symbol set, worth 65.7 bits — comfortably "strong".
It is not strong. It is the most common password in existence with a digit and a symbol on the end, and any password strength checker that says otherwise is measuring the wrong thing.
A comparison of two ways of scoring the same passwords. The character-set formula rates password at 37.6 bits, p@ssw0rd at 48.9, Password1! at 65.7 and Summer2024! at 72.3, while a guess-counting estimate rates them at 0, 2, 11.9 and 34.4 respectively. For a genuinely random password the two agree almost exactly, 124.8 against 123.8. The formula only misleads for passwords a human invented.
Counting guesses instead
This password strength checker estimates the smallest number of guesses that would work, by trying several attack routes and taking whichever is cheapest.
If the password appears in a list of 10,000 common ones, the guess count is its rank. If it is a common password with decorations, the cost is the rank multiplied by the small space those decorations occupy. Brute force is the answer only when nothing cheaper applies.
What it detects
This password strength checker looks for common passwords and their capitalised forms, digits and symbols appended to them, letters swapped for lookalikes such as @ fora, keyboard runs like qwerty, alphabetical and numeric sequences, repeated characters, repeated patterns, and bare years.
What it does not detect
Being specific about the gaps matters more than claiming to be complete:
- English words outside the 7,776-word list used for passphrase detection
- Names of people and places
- Common passwords in languages other than English
- Similarity to your own name, email address or username
The zxcvbn library covers those. It also weighs about 200KB, where this page's entire estimator including the password list is a fifth of that. If your password contains an uncommon English word, expect this password strength checker to rate it higher than zxcvbn would.
What actually makes a password strong
Length beats complexity
Every character you add multiplies the work an attacker must do, which is why a password strength checker weights length so heavily. Every symbol you substitute merely adds a rule they already have.
NIST reached the same conclusion in SP 800-63B, which requires a minimum length and explicitly forbids mandating mixtures of character types.
Uniqueness beats both
A strong password reused across sites is only as safe as the weakest site holding it. Once one leaks, attackers replay it everywhere else.
This is the one thing no password strength checker can measure. The score describes the password in isolation; it cannot know where else you have used it.
Why substitutions do not help
Turning password into p@ssw0rd moves this password strength checker's estimate from 0 bits to 2. Every cracking tool applies those swaps automatically, because everyone makes them.
The same is true of a capital at the front and a digit at the end. Those are the two most predictable decorations there are, which is exactly why they are the two people reach for.
Reading your result
The entropy figure
It is the base-2 logarithm of the estimated guess count. Below 40 bits is trivially crackable, 60 to 80 is adequate for ordinary accounts, and above 80 is comfortable — the password strength checker bands the result on that scale.
The two crack times
Both numbers describe the same password. They differ because how it was stored decides how fast it can be attacked.
Against MD5 or SHA-1 an attacker manages around a trillion guesses per second. Against bcrypt, a few thousand. You almost never get to choose which protects you, so read the fast figure this password strength checker gives as the one that matters.
What to do with a weak result
Do not patch it. Adding a symbol to a password this password strength checker just called weak moves it by a couple of bits at most.
Replace it with something generated: the password generator for anything a manager will fill in, or the passphrase generator for the few you must type from memory.
Frequently asked questions
Is my password sent anywhere?
No. It is analysed by JavaScript in your browser and never leaves the page. You can confirm it by opening your browser’s network panel while typing, or by disconnecting from the internet — the checker keeps working.
Should I type my real password?
If you have any doubt about a site, do not — and that includes this one. Typing a password of the same shape, with the same length and character mix, gives nearly the same answer with none of the risk.
Why does my password score lower here than on other sites?
Most checkers measure character variety, which rates P@ssw0rd1 highly. This password strength checker looks it up in a list of 10,000 common passwords, allows for predictable substitutions, and scores what an attacker would actually have to do.
What does the entropy number mean?
It is the base-2 logarithm of how many guesses we estimate an attacker needs. Each extra bit doubles that number. Below 40 bits is trivial to crack; above 80 is comfortable.
Why are two crack times shown?
Because the answer depends on how the site stored your password. Against a fast hash such as MD5 an attacker manages billions of guesses per second; against bcrypt, a few thousand. You rarely get to choose which one protects you.
Does adding a symbol at the end help?
Barely. Cracking rules append symbols and digits first, so password! is only marginally harder than password. Adding length, or removing the dictionary word entirely, does far more.
Does this remember what I type?
No. Nothing is written to browser storage, nothing is added to the URL, and no analytics event records the input. Closing the tab removes it completely.
My password scored well. Am I safe?
It means the password resists guessing. It says nothing about whether the site storing it has been breached, or whether you have reused it elsewhere. Uniqueness matters as much as strength.
More free generators
Every generator here runs locally in your browser, with no account and no limits, on the same terms as this password strength checker.
Password Tools
Random Generators
Keys & Secrets
Methodology
Last updated
How the estimate is calculated
guesses = min(common-list rank, decorated rank, sequence cost, repeat cost, brute force)
Each route produces a candidate guess count and the smallest wins, because an attacker takes the cheapest path available. Entropy is log₂(guesses). Brute force,charset^length ÷ 2, is included only as an upper bound and is rarely the answer for a password a person invented.
Where the estimate is conservative
Decorations are charged their full character space. Summer2024! is scored as if the trailing 2024! could be any five non-letter characters, when in practice an attacker tries years first. Real attacks on passwords of that shape are faster than this page suggests, so treat every figure here as an upper bound on your safety.
What is not checked
No English dictionary beyond the common-password list, no names, no non-English passwords, and no comparison against your own email or username. The zxcvbn library does all of that and is the better tool if you can afford roughly 200KB of JavaScript. This estimator plus its 10,000-password list is about a fifth of that size.
Privacy
The input is passed to a function and nothing else. It is never sent over the network, written to localStorage, placed in the URL, or attached to an analytics event — this site records no analytics on this page at all. Verify it with your browser's network panel, or by disconnecting from the internet.