Free Password Strength Checker
Type any password to see how long it would survive a brute-force attack — scored instantly and analyzed privately.
Analysis runs entirely in your browser. Nothing you type is sent, stored, or logged anywhere.
How to use the password strength checker
- Type or paste a password into the box — the analysis updates with every keystroke.
- Read the strength score and the estimated crack time, which assumes an attacker making ten billion guesses per second.
- Follow the improvement tips below the score until the password rates Strong or better.
- Use the Show button to double-check what you typed, then clear the field when you are done.
What makes a password strong
Length beats complexity every time. Each extra character multiplies the number of possible passwords, so a 20-character passphrase of ordinary words is vastly harder to crack than an 8-character tangle of symbols. Character variety helps too: mixing lowercase, uppercase, digits, and symbols expands the pool each position draws from, which is what the entropy figure measures. The crack-time estimate assumes a modern offline attack rig — real attackers are slower against properly hashed logins, but faster against leaked databases with weak hashing, so treat the estimate as a rough guide rather than a guarantee. Avoid dictionary words, names, dates, and keyboard patterns like "qwerty", because attackers try those first regardless of theoretical entropy. The single biggest upgrade most people can make is uniqueness: reuse one password across sites and a single breach hands attackers the keys to everything. A password manager that generates and stores a unique random password per site solves strength and uniqueness at once — pair it with our password generator to create them.
Frequently asked questions
Is it safe to type my real password here?
Yes. The check runs entirely in your browser with JavaScript — your password never leaves your device, is never transmitted, and is never logged. You can verify this by disconnecting from the internet; the tool keeps working.
How is crack time estimated?
We compute the password's entropy from its length and character pool, then divide the total combinations by ten billion guesses per second — a realistic rate for a well-equipped offline attacker. Online attacks are far slower due to rate limiting.
Why does a long simple password beat a short complex one?
Because combinations grow exponentially with length but only linearly with pool size. Adding one character multiplies possibilities by the whole pool; adding a character type only slightly enlarges the pool.
What score should I aim for?
Strong (60+) is fine for most accounts; aim for Very strong (80+) on email, banking, and password-manager master passwords. Anything under 40 should be replaced.