Password Strength Checker — Test Your Password

How strength is measured here

This estimates how resistant a password is to a realistic cracking attempt. It looks at length, the variety of character types, and — more usefully — whether the password contains predictable patterns that cracking tools specifically target.

The naive measure is entropy, calculated from length and character set size:

entropy in bits = length x log2(character set size)

But that formula assumes every character is random, and it badly overestimates real-world passwords. Password123! scores 79 bits by that arithmetic and is cracked in under a second, because it is a dictionary word with the substitutions people always make.

What weakens a password

Dictionary words in any language, including names, places and brands.
Predictable substitutions — a for @, o for 0, i for 1, s for $. Cracking tools apply every one of these automatically, so they add essentially nothing.
A capital at the start and a digit or symbol at the end. This is the shape a complexity rule pushes people into, and cracking rules exploit it directly.
Years, dates and phone numbers, especially recent years.
Keyboard patterns — qwerty, asdf, 1qaz2wsx and their variants.
Repetition and sequences — aaa, 123, abc.
Anything personal — your name, a pet, a birthday, a team. All of it is available to anyone who looks at your social media.

Time to crack

Estimates depend entirely on how the password is stored by the site, which you have no control over and no way to check.

Storage method	Guesses per second	8 random chars	12 random chars
Unsalted MD5	Hundreds of billions	Minutes	Centuries
SHA-256	Billions	Hours	Millennia
bcrypt	Tens of thousands	Centuries	Effectively never
Argon2	Thousands	Millennia	Effectively never

Because you cannot know which applies, assume the worst. Any figure a strength checker gives — including this one — is an estimate against an assumed attack, not a guarantee.

The thing a strength meter cannot see

A password can score perfectly here and still be worthless, for reasons no meter can detect:

It has already appeared in a breach. Attackers work from lists of hundreds of millions of real leaked passwords. A password on such a list is tried first, whatever its entropy. The Have I Been Pwned password service lets you check this safely without revealing the password.
You reuse it. A strong password used on ten sites fails everywhere as soon as any one of those ten is breached. This is credential stuffing, and it is how most account takeovers actually happen.
It is meaningful to you. A meter sees random characters; it cannot know the string is your daughter's name and birth year.

What to do instead of optimising a score

Rather than tuning a password until a meter turns green, the three changes that matter are: use a password manager so every site gets a different random password; turn on two-factor authentication wherever it is offered, preferring an authenticator app or hardware key over SMS; and check your email address on a breach notification service to see which of your accounts are already exposed.

Current NIST guidance also advises against forced periodic rotation, which drives people toward predictable increments, and against composition rules that mandate particular character types. Length and uniqueness are what matter.

Nothing you type is transmitted

The analysis runs entirely in your browser in JavaScript. Your password is never sent to us, logged, or stored anywhere — you can verify this in the Network tab of your developer tools. This is not a small point: entering a real password into a website that checks it server-side means handing that password to a third party.

As a general habit, be cautious about typing genuine passwords into any online checker. Testing a password of the same shape rather than the real thing is a reasonable precaution on sites whose behaviour you cannot verify.

Frequently asked questions

Is my password sent anywhere when I test it?

No. Analysis happens entirely in your browser and nothing is transmitted or stored. You can confirm this in your developer tools Network tab — no request carries what you typed.

Why does Password123! score badly despite meeting complexity rules?

Because it is a dictionary word with the exact substitutions cracking tools try first, in the exact shape complexity rules produce — capital at the start, digits and a symbol at the end. Rule-based attacks find it almost instantly.

How accurate is the time-to-crack estimate?

It is an approximation. Real cracking speed depends on how the site stores your password, which you cannot know. An unsalted MD5 hash falls billions of times faster than a properly configured Argon2 hash of the same password.

Should I change my passwords every few months?

No. Forced rotation leads to weaker, predictable variations. Use a long unique password for each site and change it when there is evidence of exposure, not on a calendar.

How do I know if my password has been in a breach?

Check it against a service like Have I Been Pwned, which uses a partial-hash lookup so the password itself is never sent. A breached password is unsafe regardless of how strong a meter says it is.