Password Strength Checker

About this tool

A weak password is the most common entry point for account takeovers, yet short or predictable passwords are still widespread. This password strength checker gives you two quick signals, computed entirely in your browser. The first is a 0–100 heuristic score with a label from Very weak to Very strong: it rewards length, the number of character types (lowercase, uppercase, digits, symbols) and the share of unique characters, and subtracts points for runs of three identical characters (aaa) or three consecutive characters (abc, 321). The second is a character-set entropy estimate — length × log2 of the pool size — with a 0–4 rating derived from it and a crack-time projection assuming every combination is tried at 10 billion guesses per second. Important limitation: the tool does not check dictionary words, leaked-password lists, dates, keyboard walks or l33t substitutions, so a predictable password such as P@ssw0rd2024! still scores 85/100 and 4/4. Treat the numbers as an upper bound that is meaningful only for randomly generated passwords.

Why use it

• Two Views of Strength: A 0–100 heuristic score with a five-segment bar sits next to a character-set entropy figure, so you can see both composition and raw length at once.

• Entropy in Bits: Entropy is computed as length × log2(pool size), where the pool adds 26 for lowercase, 26 for uppercase, 10 for digits and 32 if any symbol is present.

• Crack-Time Projection: The estimate divides the full 2^bits search space by 10 billion guesses per second — roughly a fast offline attack against an unsalted fast hash.

• Run and Sequence Penalties: Three or more identical characters in a row (aaa) and three-character ascending or descending runs (abc, 321) lower the 0–100 score.

• 100% Client-Side — Password Never Transmitted: All analysis runs in your browser using JavaScript. Your password never leaves your device.

How to use

1. Type a candidate password into the field (it stays masked) — results update as you type.
2. Read the Score (0–100) and Strength label, which reward length, character variety and unique characters and subtract points for runs like aaa or abc.
3. Read Entropy: length × log2 of the character pool (26 lowercase, 26 uppercase, 10 digits, 32 for any symbol).
4. Check the 0–4 rating, which is based on entropy alone (under 28 bits = 0, 80 bits or more = 4).
5. Read the crack-time line, which assumes every combination is tried at 10 billion (10¹⁰) guesses per second.
6. Remember the tool does not check dictionaries or leaked-password lists — a predictable password can still score high.

When it helps

• Before setting a password for a critical account, as a first check on length and character variety.
• When building a registration form and testing sample passwords to calibrate your strength policy.
• When reviewing a password manager-generated password to confirm it meets the entropy threshold your security policy requires.
• When educating users or team members about how length and character variety change entropy.
• When comparing how adding characters or character types changes the entropy of a randomly generated password.
• When testing proposed password policy changes to see how different minimum-length or character requirements affect entropy scores.

Examples

sunshine1

Score 58 / 100 (Moderate). Entropy 46.5 bits. 0–4: 2. Crack time @ 10¹⁰ guesses/sec: 2.8 hr. (No dictionary check — sunshine is a very common password.)

P@ssw0rd2024!

Score 85 / 100 (Very strong). Entropy 85.2 bits. 0–4: 4. Crack time @ 10¹⁰ guesses/sec: 141761 millennia. (Substitutions and the year are not detected.)

marble-circuit-9-frozen

Score 74 / 100 (Strong). Entropy 140.0 bits. 0–4: 4. Crack time @ 10¹⁰ guesses/sec: centuries × 10⁹+

Tips

• Length beats complexity — a random 20-character lowercase passphrase has more entropy than a 10-character password with all four character classes.
• Use three or four unrelated random words (correct horse battery staple) as a passphrase — memorable for humans and high-entropy when the words are chosen randomly.
• Avoid using names, birth years, or any personal information that could be in a targeted dictionary built from your social media profiles.
• The crack-time line assumes 10 billion guesses per second against the full character space; for human-chosen passwords treat it as a best case, not a guarantee.
• Never reuse passwords across accounts even if they score high — a strong password leaked from one breach immediately becomes weak against credential stuffing on other services.

Frequently Asked Questions

Glossary

Shannon Entropy

A measure of information unpredictability in bits, named after Claude Shannon. For passwords, higher entropy means more guesses are required to find the correct value through brute force or dictionary attacks.

Brute Force Attack

A password cracking method that systematically tries every possible character combination. Speed depends on the cracking hardware and hash algorithm — GPU clusters can attempt hundreds of billions of guesses per second against weak hash functions.

Dictionary Attack

A password cracking method that tests a list of common words, phrases, and previously leaked passwords rather than exhaustive combinations. Effective against passwords based on recognizable words or common patterns.

L33tspeak Substitution

Character substitutions that replace letters with visually similar numbers or symbols (e for 3, a for @, i for 1). These substitutions are standard in cracking rule sets and add minimal unpredictability against automated tools.

NIST SP 800-63B

The NIST Digital Identity Guidelines that define password policy recommendations for authentication. The 2017 revision deprecated mandatory complexity rules and expiration policies in favor of length and breach-list checking.

Credential Stuffing

An attack where leaked username-password pairs from one data breach are tested against other services, exploiting password reuse across accounts. Strong unique passwords per service are the primary defense.