Password Strength Checker
Type a password to see its real strength. Nothing is transmitted — the analysis runs entirely in your browser, and you can disconnect from the internet to prove it.
- Length
- —
- Character types
- —
- Entropy
- —
What actually makes a password weak
Attackers do not guess passwords character by character — they guess the patterns people use. A password like P@ssw0rd1! looks complex, hits all four character types, and falls in under a second, because cracking tools try dictionary words with exactly those substitutions and suffixes first. Meanwhile correct horse battery staple has no capitals or symbols at all and would take longer than the universe has existed. Length and unpredictability beat complexity theatre every time.
The patterns attackers try first
A modern cracking rig does not start at aaaaaaaa. It starts with everything humans reliably do.
- Leaked passwords. Billions of real passwords from past breaches are tried before anything else.
- Dictionary words with capitalised first letters, in every language.
- Leetspeak substitutions — a→@, o→0, e→3, s→$. These are reversed automatically and add essentially nothing.
- Appended numbers and symbols, especially
1,123,!and years from 1950 to 2030. - Keyboard walks like qwerty, 1qaz2wsx and zxcvbnm.
- Names and dates — pets, children, birthdays, sports teams.
This is why "must contain a number and a symbol" rules produce such predictable passwords: almost everyone satisfies them the same way, by capitalising the first letter and adding 1! at the end.
Reuse is worse than weakness
A strong password used on twenty sites is more dangerous than twenty weak but unique ones. When any one of those sites is breached, attackers immediately try the same email and password combination everywhere else — an attack called credential stuffing, and it is automated and cheap.
Practically, this means one strong passphrase you can remember for your password manager, and unique random passwords generated for everything else. That single change does more for your security than any amount of complexity in an individual password.
Check whether your addresses appear in known breaches at Have I Been Pwned.
Should you type a real password here?
An honest answer: as a rule, no — not into this site or any other.
This page does everything locally. The analysis is plain JavaScript, no request is made, and you can verify that in your browser's network tab or by turning off your connection and watching it still work. But a malicious site would tell you exactly the same thing, and you have no way to distinguish the two from the outside.
The safe habit is to test a password of the same shape as yours rather than the real one — same length, same pattern, different words and digits. You will get the same verdict without ever typing the real thing.
How to use the Password Strength Checker
- Type or paste a password into the box.
- Read the strength verdict and the specific weaknesses listed underneath.
- Fix what it flags — usually the answer is simply "make it longer".
Frequently asked questions
Is my password sent anywhere?
No. All analysis runs in your browser and the page makes no network requests. You can disconnect from the internet and it still works. That said, the safest habit is to test a similar password rather than your real one on any site.
Why is my complex password rated weak?
Almost certainly because it is built on a dictionary word with predictable substitutions or a year appended. Cracking tools try those combinations first, so the apparent complexity does not translate into real search space.
How long should a password be?
At least 12 characters, and 16 or more for anything important. Each additional character multiplies the search space, which is why length beats complexity.
What does entropy mean here?
Bits of unpredictability. Each bit doubles the guesses needed. Under 40 bits is weak, 60–80 is decent, and above 80 is strong against offline attack. This tool reduces the raw figure where it detects a predictable pattern.
Are password managers safe?
Far safer than the alternative. They generate unique random passwords, will not autofill on a look-alike phishing domain, and mean you only have to remember one strong passphrase. The concentration of risk is real but well managed by reputable ones.
Related tools
Last reviewed September 4, 2026. Results are estimates for general information only.