Password Strength Checker Online
Instantly analyze any password. See crack time estimates, entropy score, character analysis, and specific tips to make it stronger.
How this strength tester scores a password, using zxcvbn plus the entropy formula
It is worth being direct about the scoring method here, because password strength meters vary a lot in sophistication. This tool runs zxcvbn, the pattern matching library from Dropbox that checks leaked password lists, common words, names, keyboard walks, dates and repeats to estimate how many guesses an attacker really needs. It also computes the classic length and character set entropy as an upper bound, and the score is the lower of the two. So Password1! scores as Very Weak, even though the plain formula would call it 66 bits.
Everything you type stays local. The zxcvbn library is downloaded once from cdnjs when you start typing. Your password is never sent anywhere and nothing is logged. The password field itself defaults to a masked input with a toggle to reveal it.
The entropy formula, step by step
log2 of that combination count, which is mathematically identical to length times log2(pool size). This is an upper-bound estimate. It assumes every character was chosen at random, which is generous for a human-typed password. So zxcvbn also splits the password into the patterns it recognises and counts the guesses for each. The lower of the two numbers wins.
The five crack-time scenarios
| Scenario | Guess rate | What it represents |
|---|---|---|
| Online login, rate limited | 100 per second | Typical web login throttling after failed attempts |
| Online, no throttle | 10,000 per second | An API endpoint without rate limiting |
| Offline MD5 attack | 10 billion per second | A single consumer GPU cracking a fast, unsalted MD5 hash |
| Offline bcrypt attack | 20,000 per second | bcrypt at cost factor 12 on a single GPU, deliberately slow |
| Massive cluster | 10 trillion per second | Nation-state scale distributed cracking hardware |
The bcrypt row is the one worth paying attention to. It shows how dramatically a slow, purpose built password hashing algorithm changes the practical math even against powerful hardware, which is the entire argument for why sites should never store passwords as fast hashes like plain MD5 or SHA-256.
The pattern checks layered on top of entropy
Every pattern zxcvbn finds is listed with the part of the password it matched, for example a common password with its rank in leaked lists, an English word, a name, a keyboard walk, a date or a repeat. zxcvbn’s own warning and suggestions are shown too, plus checks for length, letters only or digits only, and mixed case, digits and symbols. If the pattern library cannot load, a basic set of regex checks and a list of very common passwords take over. Each generates a colour-coded tip: green for good, amber for a warning, red for a serious problem.
Two extra features worth knowing
Built-in secure generator
The Generate button on this page uses window.crypto.getRandomValues with rejection sampling so every character is equally likely, and it makes sure each type you selected appears. It is the same cryptographically secure source used by the dedicated password generator tool, not Math.random, so a freshly generated test password is genuinely random.
Copyable strength report
The Copy Report button assembles a plain-text summary, grade, entropy, length, character set size, and all five crack times, onto your clipboard, useful for pasting into a ticket or documentation when justifying a password policy change.
- NIST SP 800-63B is the current federal digital identity guideline that shaped modern thinking on password length over complexity rules.
- zxcvbn is the open source pattern-matching strength estimator this tool uses for its realistic score.
- Password strength background covers the entropy formula and its known limitations in more depth.
- Have I Been Pwned Passwords is the tool to actually check whether a password has appeared in a known breach, something no entropy calculation can tell you.
Judging a password honestly
Checking a password you are about to reuse before committing to it, sanity testing a company password policy's minimum length requirement against realistic crack times, teaching the difference between a fast hash and a slow one through the MD5 versus bcrypt comparison, and generating and immediately scoring a fresh random password when a site forces you to change one on the spot.
FAQ: Password Strength Checker Online
Yes. All analysis runs inside your browser using JavaScript. Your password is never sent to any server, never logged, and never stored anywhere. You can verify this by disconnecting from the internet before typing.
Strength is based on entropy in bits, calculated from password length and the size of the character set used (lowercase, uppercase, digits, symbols). Entropy measures unpredictability. Common patterns like keyboard walks or repeated characters reduce the effective score.
Crack times are estimated against different attack speeds: online login attempts (limited by rate throttling), offline dictionary attacks, and GPU brute-force at roughly 10 billion guesses per second. Longer, more complex passwords increase crack time exponentially.
Length is the biggest factor. A 20-character password using only lowercase letters is stronger than an 8-character password with mixed types. Ideally combine length with character variety and avoid dictionary words, common substitutions like @ for a, or predictable patterns.
Yes, if you store it in a password manager. Generated passwords are genuinely random and very strong. If you need something you can memorize, try a passphrase of 4 or more random words instead, which gives high entropy and is easier to recall.
From the blog
Security writing without the scare tactics
Practical explanations of hashing, headers, certificates and consent, aimed at people who have to ship something this week.
