How to use it
- Type or paste the password into the box. It is hidden by default; use “Show” to check what you typed.
- Read the strength label, the entropy figures and the rough crack-time estimate.
- Look at the patterns found and follow the tips to make the password harder to guess.
How it works
The checker starts with character-pool entropy: the number of possible characters (26 lowercase, 26 uppercase, 10 digits, 33 ASCII symbols including space, and 100 for any other character such as letters with accents or emoji) raised to the power of the length, expressed in bits as log2(pool) × length. That figure assumes every character was chosen at random, which is rarely true for passwords people make up.
It then looks for patterns that attackers try first and charges each matching part only the bits needed to guess the pattern: a built-in list of the 1,000 most common passwords, about 3,000 frequent English words and 600 common first names (also after undoing leetspeak such as 4→a, 3→e, 0→o, $→s), keyboard runs like qwerty and asdf, sequences like abc or 4321, repeated characters or blocks, years from 1900 to 2099 and dates such as 12/05/1990 or 19900512. The result is the “estimate after patterns”. The method is similar in spirit to the open-source zxcvbn estimator, but simpler.
The crack time assumes 10 billion guesses per second, roughly what a few modern graphics cards achieve against a fast, unsalted hash such as MD5 or SHA-1 in an offline attack, and that half of the remaining possibilities must be tried on average. Online attacks against a login form are far slower; well-configured slow hashes are much slower too. Treat the figure as an order of magnitude, not a promise. The checker does not know whether your password has appeared in a data breach.
Examples
A typical “strong-looking” password
“Summer2023!” has 11 characters and all four character types, so its character-pool entropy is about 72 bits. The checker finds the word “Summer” and the year 2023, and the estimate drops to roughly 22 bits: very weak, guessable in well under a second offline.
Leetspeak does not help
“P@55w0rd” is recognised as “password” with substitutions, which is one of the most common passwords. It is rated very weak no matter how many symbols it contains.
A random password
A 16-character password from a generator, such as “v7#Qm!2pXr9$Lw4z”, has no detectable patterns. Its estimate equals the character-pool figure of about 105 bits, which is rated very strong.
Frequently asked questions
Is it safe to type my real password here?
The analysis runs entirely in your browser with JavaScript on this page. The password is not sent to a server, saved, or included in analytics. If you prefer, check a password with the same structure instead of the real one.
Why is my password weaker than the entropy number suggests?
Character-pool entropy assumes every character is random. Words, names, dates and keyboard patterns are tried early by cracking tools, so the checker counts them as much easier to guess. The “estimate after patterns” figure reflects that.
Does this check whether my password has been leaked?
No. It only compares against a built-in list of 1,000 very common passwords and estimates guessability. A breach check needs a separate service; if you use one, choose one that only receives part of the password's hash.
What is a good target?
For most accounts, aim for “strong” (60 bits or more after patterns). For a password manager master password or email account, aim for “very strong” (80 bits or more), for example a passphrase of six random words.
Why do different strength meters give different results?
Each meter uses its own word lists, pattern rules and attacker-speed assumptions. Simple meters only count character types, which overrates passwords like “Password1!”. Use any estimate as guidance rather than an exact measurement.
Privacy
The password is analysed only in your browser. It is not uploaded, stored, logged or sent to analytics; only an anonymous event that the tool was used is recorded. The common-password and word lists are part of the page, so no lookup is made over the network.