🛡️ Security

Password Strength Checker

Analyze the strength of any password: length, character classes, entropy in bits and resistance estimate. Processed in the browser — the password never leaves your device.

Password

How is the strength calculated?

What gets measured here is entropy in bits: the higher it goes, the more work it takes to guess the password by brute force. From 60 bits of entropy onward, you can treat the password as strong for most uses.

Will your password survive an attack?

A "strong" password isn't the one that looks complicated. Strong is the one that's hard to crack. This tool analyses any password and measures what really counts: the length, the variety of character types, and the entropy in bits, which is the true measure of how unpredictable it is.

Working from those factors, the tool gives a resistance estimate: it sizes the search space, the alphabet raised to the length, with no dictionary and no hunt for patterns. That is why "abc123" comes out weak, at 31 bits, while a long, genuinely random password fares much better. Treat it as a gauge before setting the password for an important account, or for checking whether the one you've dragged along for years still holds up.

The whole analysis runs in the browser and the password leaves neither your device nor any log. Even so, to be safe, avoid testing here the actual password that guards your critical accounts.

Frequently asked questions

Does this checker tell me whether my password has shown up in a breach?

No. The score here is plain arithmetic: length multiplied by the logarithm of the character set in use. There is no dictionary, no common-password list and no breach database, so a well-known password can still score well. To test exposure, use a checker built on the HIBP range API, which never sends the full password.

Why does a password made of one repeated letter still rate as reasonable?

Because the formula assumes characters drawn at random. Twelve identical lowercase letters count as 12 times 4.7, roughly 56 bits, which lands in the middle band, even though an attacker would guess it on the first try. The meter sizes the search space, not the predictability of your choice: patterns, dates and dictionary words go unnoticed.

How many bits of entropy are enough?

The scale used here runs: under 28 bits very weak, up to 40 weak, up to 60 reasonable, up to 100 strong, and anything above that very strong. Each character drawn from the 94 on a keyboard adds about 6.5 bits, so twelve genuinely random characters clear 78 bits. A passphrase of four or five random words reaches similar ground and is far easier to recall.

Related Tools

🔐

Bcrypt Hash Generator

Generate secure bcrypt hashes from passwords and verify whether a password matches an existing bcrypt hash.

🔐

JWT Secret Strength

Measures the strength of an HMAC JWT secret: byte length, approximate entropy and rating.

🚫

Common Password Blacklist Check

Checks a password against the top 1000 most-used passwords, fully client-side, and flags it as compromised.

⏱️

Password Crack Time Estimator

Estimates brute-force cracking time for a password in three scenarios (online, offline and GPU), from its length and character set. It does not check any leaked-password dictionary.

🔐

Password Generator

Generate strong, random passwords with custom length, uppercase letters, numbers and symbols. Generated in the browser — no data leaves your device.

📋

Password Policy Batch Auditor

Tests a list of passwords against the policy you define, showing which fail, which rules they break and the equivalent regex.