Password Strength Checker

How to use the password strength checker

1. Type a password — or better, one of the same shape.
2. Read the verdict and the specific weaknesses listed.
3. Lengthen it rather than adding more symbol substitutions.

About this tool

Strength is estimated from entropy — the size of the search space an attacker faces — with deductions for the patterns cracking tools try first: common passwords, keyboard runs, counting sequences and repeated characters. A twelve-character password made of those is far weaker than its length suggests.

The crack times assume an offline attack at 100 billion guesses a second, which is a realistic figure for commodity hardware against a poorly hashed database. Against a well-implemented slow hash the same password lasts far longer, and against a site that rate-limits logins, longer still.

One risk arithmetic cannot see: reuse. A password exposed in any past breach is guessed instantly regardless of how strong it looks here, which is why unique passwords matter more than clever ones.

Common uses

• Sanity-checking a password scheme before adopting it.
• Showing why a 'complex' short password is weak.
• Comparing a passphrase against a random string.

Frequently asked questions

Is my password sent anywhere?

No. The calculation is arithmetic in this page. Even so, testing a password of the same shape rather than a real one is the safer habit anywhere online.

Why is my clever substitution password rated weak?

Because P@ssw0rd-style substitutions are the first thing cracking tools try. Length beats cleverness by a wide margin.

Why does length matter more than symbols?

Each extra character multiplies the search space, while adding a character class only widens the base. Twenty lowercase letters beat ten mixed characters comfortably.