Overview
People judge passwords by appearance — a tangle of symbols feels strong, a plain word feels weak. Attackers do not judge by appearance at all; they count. This checker counts the way they do, converting your password into two honest numbers: its entropy in bits, and a realistic estimate of how long it survives a sustained guessing attack. If the answer surprises you, the surprise is the lesson.
Because passwords are the most sensitive strings most people own, the page was built to transmit nothing. Type freely, test candidates, compare options — then close the tab knowing no copy of what you typed exists anywhere except the screen in front of you.
What does ‘strength’ actually mean?
A strong password is one whose search space is too large to exhaust. That space is measured in bits of entropy: every bit doubles the guesses an attacker needs. Forty bits means about a trillion guesses on average; eighty bits means more guesses than stars in the observable universe. The checker derives your score from the password's length and the size of the character pool it draws from.
Entropy is not the whole story, which is why the page also hunts for patterns. A twelve-character ‘Password123!’ looks decent on paper, yet guessing software tries exactly that shape early. Common passwords, keyboard walks, repeated characters and short lengths each earn a plain-spoken warning — because a password is only as strong as its weakest habit.
Features
- Live entropy readout in bits, computed from the character families your password actually uses.
- Crack-time estimate in plain words — from ‘instantly’ to ‘millions of years’ — at a realistic attack speed.
- Common-password detection against the internet's most-abused passwords, which attackers always try first.
- Pattern warnings for keyboard sequences, alphabet runs, repeated characters and short lengths.
- Pool breakdown showing which character families appear and which are missing.
- Zero transmission: no network requests, no storage, no analytics on what you type — verifiable in your browser's network tab.
Benefits
- Numbers, not vibes. Learn whether a password is actually strong or merely looks strong.
- Fix the weakest link first. Each warning names a concrete flaw instead of leaving you guessing.
- Safe experimentation. Test ten candidates in a minute; nothing is recorded anywhere.
- Works offline. Once loaded, the page needs no connection at all.
Who can use it
Anyone choosing a password that matters — a new master password, a Wi-Fi key, an encryption passphrase, the login to an account that guards money or email. It is also instructive for the curious: paste in an old retired password (one used nowhere now) and see how it scores. IT staff can use it to show colleagues why ‘Company2024!’ was never the fortress it resembled.
How to use
- Type or paste the password into the box at the top of the tool.
- Read the grade and entropy score as they update with every keystroke.
- Check the crack-time estimate to feel what the number means in practice.
- Work through the warnings one by one — each names a specific weakness to fix.
- Adjust the password (usually: make it longer) until the warnings clear and the grade reads Strong or better.
Frequently asked questions
Is it safe to type my real password here?
Yes, because nothing leaves your device — the page contains no code that could transmit what you type, and your browser's network tab will confirm zero requests. Still, as a standing precaution, never test a password you currently use on an important account; test candidates and retired passwords instead.
What attack speed does the estimate assume?
Ten billion guesses per second — roughly one high-end graphics card against fast hashes. Good password hashing (the kind careful sites use) slows attackers enormously; a leaked database of fast hashes lets them go quicker. The estimate is deliberately conservative: assume the attacker is fast.
My password scored ‘Fair’ — is that enough?
For a throwaway forum account, probably. For email, banking, or anything that can be used to reset your other accounts, aim for Strong or Very strong. The cheapest upgrade is almost always length: four extra characters beat nearly any clever substitution of symbols, because each character multiplies the search space. Add length first, then worry about character variety.
Why was my long password flagged?
Because it matched a known pattern — typically a common password with minor tweaks, like ‘Password123!’, or a keyboard walk such as ‘qwerty’. Attackers keep dictionaries of exactly these shapes and try them early, so the checker warns you even when the raw entropy looks respectable on paper. Structure matters as much as statistics.
Does a top score mean the password can't be broken?
No score can promise that. Strength only covers guessing attacks; it says nothing about phishing emails, malware on your device, or a website that stores passwords carelessly. A strong, unique password plus two-factor authentication is the combination that actually holds up in the real world — treat the score as one layer, not the whole defence.
Conclusion
Strength is arithmetic, not aesthetics — a number you can measure, not a look you can admire. Run your candidates through the checker, fix whatever it flags (usually by adding length rather than symbols), and stop trusting passwords that merely look complicated. Let the numbers do the defending from now on.