Password Strength Checker

Most password strength meters only do the arithmetic. They count how many character types you used, and the second you add a ! the bar goes green, even on a password a cracking rig would break before lunch. Type a password above and this checker runs that same arithmetic, then it docks the score for the exact patterns attackers try first: breached passwords, keyboard runs, a plain dictionary word with a number bolted on the end. So the clever-looking disguises that sail past other meters score weak here, which is the honest result.

You get three things instantly. The entropy in bits (how many guesses an attacker faces), an estimated crack time, and a checklist of what's dragging the score down and how to fix it.

And it never sees your password. A checker that phones home makes no sense, you're about to type a secret into the thing. This one runs entirely inside your browser. No server, no API call, no "we only store a hash, promise." Switch off your Wi-Fi and it still works, because there was never anything to send.

1. Type or paste a password into the box. The analysis updates on every keystroke, and nothing leaves your device while you type.
2. Hit Show to reveal what you typed. Handy when you've pasted something from a manager and want to eyeball it.
3. Read the meter and label (Very weak through Very strong), with the entropy in bits underneath. Higher is better, and every extra bit doubles the work an attacker has to do.
4. Look at the estimated crack time, the average time to guess it offline at roughly 10 billion tries a second.
5. Scan the checklist. Green is what you got right, red is the specific fixable problem, from too short or a missing character type to a repeated run, a sequence, or a breach-list password.
6. Change one thing and watch the number move. Adding four characters can drag the crack time from days to centuries, which is the whole lesson right there.

This is the whole reason the tool exists, so let me be specific. P@ssw0rd! has upper case, lower case, a digit, and a symbol. Run the raw formula and you land around 59 bits, which sounds respectable, so a meter that stops there paints a healthy-looking bar and sends you on your way.

But nobody cracking passwords brute-forces from aaaaaa upward. They start with the passwords that top every breach dump, then dictionary words, then dictionary words with the predictable human touches: a capital first letter, a number on the end, letters swapped for lookalikes (a to @, o to 0, s to $). P@ssw0rd! is just the word "password" run through the two most common rules on the planet, so it falls in the first fraction of a second of a real attack. The formula measures the size of the keyspace. Whether an attacker searches all of it is a different question, and against something this guessable they barely have to search at all.

This checker knows those moves. It strips the trailing digits and symbols off your password and checks the base word against a built-in list of the worst offenders, so dragon2024 gets caught the same way dragon does. It flags repeated runs like aaaa and 111111, and it catches keyboard and alphabet sequences like qwerty, 1234, and their reverses. When it finds one, it doesn't just tack on a warning, it cuts the effective entropy hard and re-rates the password on whatever's actually left. That's why the number you see reflects guessability, not the raw size of the keyspace.

The instinct, when a site nags you for something stronger, is to reach for more symbols, and that is mostly wasted effort. In the entropy math, length is a straight multiplier and the character pool only moves a slow-growing log term. Adding one more character to a mixed-symbol password buys you about 6.5 bits. Making the password twice as long doubles the entire bit count.

Put real numbers on it. An 8-character password using all four types draws from a pool of 94, about 52 bits. A 16-character password of nothing but lowercase draws from a pool of 26, about 75 bits, and it's millions of times harder to crack with no symbols or capitals at all. This is why a passphrase of four or five random words beats a short string of random symbols you can't remember.

So the rule that actually helps: when a site lets you go long, go long. Sixteen characters is a solid target, twenty-plus for the accounts that guard everything else, your email, your bank, your password manager's master password. If a site caps the length at some stingy number, max it out and use every character type you can, because now the small pool is all the strength you've got. None of that is a contrarian opinion. NIST's guidance (SP 800-63B) says the same thing bluntly: favor length, screen against known-breached passwords, and drop the arbitrary complexity rules that just push everyone toward Password1!.

The crack-time estimate assumes the frightening case, an offline attack. Someone stole the site's password database in a breach and is grinding the stolen hashes on their own hardware, no rate limit, no lockout, no CAPTCHA in the way. That's the scenario your password has to survive when, not if, some service you joined years ago gets popped. Online guessing against a live login form is throttled to a few tries a second and almost never how accounts actually fall.

What the figure can't know is how the site stored your password. A slow hashing algorithm like bcrypt or argon2 makes real cracking around a million times slower than the 10-billion-a-second rate quoted here, an old raw MD5 or SHA-1 makes it faster. You don't get to pick which one they used, so the tool assumes the fast attacker. The 10-billion figure is not invented here. It is the offline fast-hash scenario zxcvbn publishes, sitting alongside 10,000 a second for a slow salted hash and 10 a second against a live login form, so the million-fold gap above is the distance between two figures in one published set. Clear that bar and you clear every weaker one underneath it. Treat the time as a rough gauge for building intuition rather than a guarantee of how long you're actually safe.