Free Password Strength Checker
A password strength checker estimates how hard a password would be to guess. Type a password and this free tool works out its length, the character types used and an entropy estimate in bits, then flags weak patterns such as common passwords, keyboard runs, repeats, sequences and years. It gives a rating and specific advice to improve it. Nothing is stored or sent anywhere.
Password Strength Checker
Generators and Converters
About this tool
Strength comes mostly from length and unpredictability. The tool multiplies the number of different characters you could have used (lowercase, uppercase, digits, symbols) by the length to estimate entropy in bits, then subtracts credit for patterns attackers try first: very common passwords, keyboard runs like qwerty, counting sequences like 1234 or abcd, repeated characters, and four-digit years. Each extra bit doubles the number of guesses needed, so a few extra characters help more than swapping an a for an @.
The time estimates are examples with stated assumptions, not predictions. They show how long a full search of the possible combinations would take if an attacker could make a fixed number of guesses per second against a stolen list of hashed passwords, and a much lower number against a login form that limits attempts. Real attackers first try leaked and common passwords, which is why a common password is treated as weak whatever its length.
Good practice is simple. Use a long passphrase of four or more unrelated words, or a random string from a password manager, a different one for every account, and turn on two-factor sign-in for email, banking and your website admin. This checker cannot tell whether a password appeared in a breach, because that check requires sending the password or part of it to another service, which we do not do. To check breaches, use a trusted breach notification service with your email address instead.
Frequently asked questions
Is it safe to type my password here?
The check runs on our server for this one request, and the password is not stored, logged or passed to any other service. Even so, the safest habit is never to type your real password into any web page except the site it belongs to. Test a similar password with the same length and style instead.
What is entropy in bits?
Entropy measures unpredictability. A password with 40 bits of entropy could take about two to the power of 40 guesses to find by brute force, and every extra bit doubles that. As a rough guide, under 40 bits is weak, 60 bits is reasonable for online accounts and 80 or more is strong against offline attacks.
Why is a long password with common words weak?
Attackers do not try every combination first. They try leaked passwords, common words, names, keyboard patterns and popular substitutions like a for @ before anything else. A password built from one of those is found quickly whatever its length. Random words that are unrelated to each other are much harder to guess.
Are the crack time estimates accurate?
They are only examples. The tool states the guess rate it assumes, and real rates vary widely with the attacker's hardware and how the site stores passwords. Treat the numbers as a way to compare two passwords, not as a promise of how long a password will last.
How long should a password be?
At least 12 characters for ordinary accounts, and longer for email, banking and admin accounts. A passphrase of four or five unrelated words is long, memorable and strong. Use a different password for each account, and a password manager so you do not have to remember them.