Password Strength Checker

Free password strength checker that scores your password by length, character variety, and common weak patterns. Everything runs in your browser — nothing is sent anywhere.

What is a password strength checker?

A password strength checker is a free tool that looks at a password's length, the variety of characters it uses, and common weak patterns — sequential runs, repeated characters, keyboard layouts, and known leaked passwords — to estimate how hard it would be for someone to guess. The result is shown as a five-level rating from "Very weak" to "Very strong," along with an estimated entropy in bits and a rough time-to-crack estimate for a few different attack scenarios.

Where our existing crypto.generator.password tool helps you create a brand-new random password, this tool works in the opposite direction: it evaluates a password you've already thought up or are already using. Whatever you type is never sent anywhere — every calculation happens locally, right inside your browser.

How to check your password strength

Enter the password you want to check Type it into the input field and your results update instantly as you type.
Use "Show" to double-check what you typed Click "Show" to reveal the characters if you want to confirm there's no typo.
Read the strength meter and any warnings Check the five-level meter along with the list of any weak patterns detected.
Review the estimated time to crack Compare the online and offline attack scenarios to see roughly how long a brute-force attempt would take.
Adjust the password if needed If the rating is too low, try making it longer, mixing in more character types, or removing any predictable patterns.

Tips for getting more out of it

You don't have to type in the exact password you actually use. A stand-in with the same length, character mix, and pattern will give you a very close read on its strength. Checking happens entirely on your device, so typing your real password is safe too — but this trick is handy if you'd still rather not.
Even a "very strong" rating doesn't protect you if you reuse that password on other sites. One leak anywhere means every account sharing that password is now at risk. Use a different password for every service.
Adding one more character to a password usually strengthens it more than adding one more symbol does. If you're not sure what to change, try lengthening it before reaching for more character types.
The "estimated time to crack" figures are theoretical worst-case estimates for brute-force guessing. Real attackers also use dictionary attacks and personal details as shortcuts, so don't treat these numbers as a guarantee.
Paste a password generated by crypto.generator.password (our random password generator) into this checker to confirm it actually lands at the strength you were aiming for.

When to use a password strength checker

Before signing up for a new account

Check a password you're about to use for a new service to make sure it's strong enough before you commit to it.

Auditing passwords you've had for years

A good opportunity to revisit old passwords and see whether they still hold up against current standards.

Explaining password policy at work

A live demonstration is a great teaching tool for showing colleagues why length matters more than complexity.

Verifying a password generator's output

Paste in a password created with crypto.generator.password to instantly confirm it hits the strength level you expected.

Glossary

Entropy: A measure, in bits, of how unpredictable a password is. More characters and more character variety both push this number higher, which grows the number of combinations an attacker would need to try exponentially.
Brute-force attack: An attack method that mechanically tries every possible combination of characters until it finds the correct password.
Dictionary attack: An attack method that prioritizes commonly used words, phrases, and lists of previously leaked passwords. Simple words and known weak passwords get found far faster than a pure brute-force search would take.
Credential stuffing: An attack that takes an email-and-password combination leaked from one service and tries it against other services. Reusing passwords is what makes this attack effective.
Salt: A random string added to a password before it's hashed for storage. It ensures identical passwords produce different stored values, which defeats precomputed lookup tables like rainbow tables.
Password manager: Software that generates, remembers, and automatically fills in a unique, complex password for every service you use, so you can have strong passwords everywhere without reusing any of them.
Passkey: A passwordless authentication method that verifies your identity using your device's biometrics or screen lock instead of a typed password. It's considered highly resistant to phishing and credential leaks.

Frequently asked questions

No. All of the checking happens locally in your browser's JavaScript, and the string you type is never sent to any server. Once you close the page, nothing about it remains.

No. This is a theoretical estimate based on length, character variety, and known weak patterns. You can still be compromised through phishing or a breach on the service's end, neither of which has anything to do with password strength. Turning on two-factor authentication wherever it's offered is strongly recommended.

It's a numeric measure of how hard a password is to guess. Each additional bit roughly doubles the number of combinations an attacker would need to try. As a general rule of thumb, 60 bits or more is considered comfortably strong for everyday use.

Because when an email-and-password combination leaks from one service, attackers automatically try that same pair on other popular services — a technique called credential stuffing. No matter how strong the password itself is, reusing it means a single leak can compromise every account tied to it.

Symbols do expand the pool of possible characters, but the effect is usually smaller than simply making the password longer. A good approach is to get the length solid first, then add extra character types if you have room to spare.

Side Note — The myth of password "complexity"

For years, most services required passwords to mix uppercase letters, lowercase letters, numbers, and symbols. The rule sounded reasonable, but it overlooked something important: humans are bad at memorizing strings of characters that don't form a pattern. In practice, most people settled on the same predictable trick — capitalize the first letter of a word and tack a digit and a symbol onto the end, producing endless variations of "Password1!". Attackers know this habit well, so these exact transformations are among the very first things tried in an automated cracking attempt.

In 2017, the U.S. National Institute of Standards and Technology (NIST) rewrote its guidance on the subject in Special Publication 800-63B, and the shift was significant. Rather than forcing frequent password changes and complex character requirements, NIST recommended prioritizing length instead, since long passwords are dramatically harder to brute-force than short ones regardless of how "complex" they look. There's a neat, almost counterintuitive result here: a long passphrase built from a handful of unrelated words is often both easier for a person to remember and harder for a computer to crack than a short jumble of random symbols.

That said, leaning entirely on human memory has real limits, even with longer passwords. That's part of why password managers — which generate and store long, random strings so you never have to memorize them — have become so widely recommended, and why the industry is increasingly moving toward passkeys: a passwordless approach that relies on your device's biometrics or screen lock instead of a string you type in. Running your own passwords through a checker like this one is a good way to see where you currently stand, and to decide whether it's time to take that next step.

Browse all trivia