Password Strength Checker
Estimate how resistant a password is to guessing, with specific findings on dictionary words, patterns, sequences and repeats. Nothing is stored or sent.
Up to 512 characters. Nothing you type leaves this page.
How it works
- Type or paste a password. The check runs as you type, entirely in your browser.
- Read the findings: each one is a pattern that real cracking tools exploit.
- Compare the naive figure other calculators show with this tool’s estimate.
Frequently Asked Questions
Is my password sent anywhere?
No. The check runs entirely in your browser, the password is never stored or transmitted, and no part of it appears in any analytics event. Closing the tab discards it.
Is this a measurement of entropy?
No, and that is the important caveat. The entropy of a password a person chose cannot be computed. The tool shows the naive length x log2(pool) figure that other calculators print, alongside its own ESTIMATE after penalising the patterns real cracking tools exploit. The estimate is a heuristic and is labelled as one.
Why is "Password1!" rated so poorly?
Because attack rule sets lowercase it, undo the substitutions and strip a trailing digit-and-symbol suffix for free, leaving a common dictionary word. The naive calculation rates it highly, which is exactly the false comfort this tool is built to avoid.
What does the crack time mean?
A worst case: an offline attack on a fast, unsalted hash at roughly 100 billion guesses per second. A properly stretched password hash is many orders of magnitude slower to attack, so treat the figure as a lower bound on safety, not a prediction.
Does it check whether my password was in a breach?
No. That would require sending part of your password to a remote service, which conflicts with this site’s local-only model. A short list of the most common passwords is checked locally instead, and the tool is explicit that this is not a full breach corpus.