Checkers & Validators
Password Strength Checker
Score any password, get a crack-time estimate and specific improvement tips.
Password
Nothing you type leaves your browser. No network call, no analytics, no storage.
Strength
Very weak
Score 0 / 4
Length
0
Alphabet size
0
Entropy
0 bits
Estimated offline crack time
instantly
Assumes 10^10 guesses/sec against a fast hash (MD5 / SHA-1). Slow hashes (bcrypt, argon2) buy many more orders of magnitude.
How to make it stronger
- Type a password to see its strength.
About this tool
Type any password and see a live score from 0 (very weak) to 4 (very strong), an estimated offline crack time based on entropy, and a list of specific things you can do to make it stronger. Scoring covers length, character-class diversity (lowercase / uppercase / digits / symbols), penalties for repeated characters and simple sequences (abc, 123, qwerty), and a common-password block-list of the 50 most-leaked passwords. Runs 100% in your browser - the password is never sent anywhere, never logged and never left on the page after you close the tab.
FAQs
Does my password leave the browser?
No. All scoring runs in JavaScript inside your browser tab. There is no server call, no analytics event on the password itself and nothing is stored - refresh the page and the input is gone.
How is the crack-time estimate calculated?
We approximate entropy from the alphabet you used (26 letters, 52 with case, 62 with digits, ~94 with symbols) and the length, then divide by 10^10 guesses per second - a rough figure for a well-funded offline attack against a fast hash like MD5 or SHA-1. Slow hashes like bcrypt / argon2 buy you many more orders of magnitude, so treat the estimate as a worst case.
Why does 'P@ssw0rd!' score so low despite having symbols and digits?
It matches the common-password pattern (the base word 'password' plus a predictable leet substitution). Real attackers run wordlists with substitutions applied - character-class diversity does not help if the underlying pattern is famous. Aim for length and randomness over cute substitutions.
What's the difference between a score of 3 and a score of 4?
Score 3 is 'strong enough for normal accounts' - roughly 60 bits of entropy, would take years to crack offline. Score 4 is 'safe against nation-state offline attacks' - 80+ bits, effectively unbreakable within a human lifetime. Score 4 is worth targeting for password manager master passwords and account-recovery answers.
Should I use this checker on my real passwords?
Yes - because nothing leaves the browser. Do not paste real passwords into checkers that show you a 'sharing' or 'save' button or that send the value to any server; those have been used to harvest credentials in the past.