Password Strength Checker Online
Instantly analyze any password. See crack time estimates, entropy score, character analysis, and specific tips to make it stronger.
How this strength tester scores a password, and how that differs from zxcvbn
It is worth being direct about the scoring method here, because password strength meters vary a lot in sophistication. This tool does not run zxcvbn, the pattern matching library that cross references dictionaries, keyboard walks, and date formats to estimate realistic guessing difficulty. It uses a character-set-and-length entropy formula combined with a set of regular expression checks for common weak patterns. That is a simpler, faster and fully client side approach, and it is transparent about its own math, but it will score something like Password1! more generously than a tool that specifically knows that phrase tops every leaked password list.
Everything you type stays local. There is no fetch call anywhere in this tool, no analytics ping on keystrokes, nothing sent anywhere. The password field itself defaults to a masked input with a toggle to reveal it.
The entropy formula, step by step
log2 of that combination count, which is mathematically identical to length times log2(pool size). This is an upper-bound estimate. It assumes every character was chosen independently and randomly, which is generous for a human-typed password built from a real word or a memorable pattern.
The five crack-time scenarios
| Scenario | Guess rate | What it represents |
|---|---|---|
| Online login, rate limited | 100 per second | Typical web login throttling after failed attempts |
| Online, no throttle | 10,000 per second | An API endpoint without rate limiting |
| Offline MD5 attack | 10 billion per second | A single consumer GPU cracking a fast, unsalted MD5 hash |
| Offline bcrypt attack | 20,000 per second | bcrypt at cost factor 12 on a single GPU, deliberately slow |
| Massive cluster | 10 trillion per second | Nation-state scale distributed cracking hardware |
The bcrypt row is the one worth paying attention to. It shows how dramatically a slow, purpose built password hashing algorithm changes the practical math even against powerful hardware, which is the entire argument for why sites should never store passwords as fast hashes like plain MD5 or SHA-256.
The pattern checks layered on top of entropy
Because raw entropy alone can be misleading, a separate set of regex checks flags specific weak patterns regardless of what the bit count says: passwords that are letters only or digits only, three or more repeated characters in a row, a match against a short list of extremely common passwords like password, qwerty or letmein, a word followed by one to four digits, a whole-password repeated sequence, and simple positive checks for mixed case, digits and symbols. Each generates a colour-coded tip: green for good, amber for a warning, red for a serious problem.
Two extra features worth knowing
Built-in secure generator
The Generate button on this page uses window.crypto.getRandomValues with a Uint32Array, the same cryptographically secure source used by the dedicated password generator tool, not Math.random, so a freshly generated test password is genuinely random.
Copyable strength report
The Copy Report button assembles a plain-text summary, grade, entropy, length, character set size, and all five crack times, onto your clipboard, useful for pasting into a ticket or documentation when justifying a password policy change.
- NIST SP 800-63B is the current federal digital identity guideline that shaped modern thinking on password length over complexity rules.
- zxcvbn is the pattern-matching strength estimator this tool intentionally does not implement, worth reading if you want to understand the gap between entropy math and realistic guessability.
- Password strength background covers the entropy formula and its known limitations in more depth.
- Have I Been Pwned Passwords is the tool to actually check whether a password has appeared in a known breach, something no entropy calculation can tell you.
Judging a password honestly
Checking a password you are about to reuse before committing to it, sanity testing a company password policy’s minimum length requirement against realistic crack times, teaching the difference between a fast hash and a slow one through the MD5 versus bcrypt comparison, and generating and immediately scoring a fresh random password when a site forces you to change one on the spot.
FAQ: Password Strength Checker Online
Yes. All analysis runs inside your browser using JavaScript. Your password is never sent to any server, never logged, and never stored anywhere. You can verify this by disconnecting from the internet before typing.
Strength is based on entropy in bits, calculated from password length and the size of the character set used (lowercase, uppercase, digits, symbols). Entropy measures unpredictability. Common patterns like keyboard walks or repeated characters reduce the effective score.
Crack times are estimated against different attack speeds: online login attempts (limited by rate throttling), offline dictionary attacks, and GPU brute-force at roughly 10 billion guesses per second. Longer, more complex passwords increase crack time exponentially.
Length is the biggest factor. A 20-character password using only lowercase letters is stronger than an 8-character password with mixed types. Ideally combine length with character variety and avoid dictionary words, common substitutions like @ for a, or predictable patterns.
Yes, if you store it in a password manager. Generated passwords are genuinely random and very strong. If you need something you can memorize, try a passphrase of 4 or more random words instead, which gives high entropy and is easier to recall.
From the blog
Security writing without the scare tactics
Practical explanations of hashing, headers, certificates and consent, aimed at people who have to ship something this week.
