Password Strength Checker

Password Strength Checker estimates how hard a password would be to guess, and explains why. The headline figure is entropy in bits, which measures unpredictability: each extra bit doubles the number of guesses an attacker needs on average.

Entropy alone is not the whole story, so the checker also looks for the patterns that make a password far weaker than its length suggests. Dictionary words, keyboard runs like qwerty, sequences like 1234, repeated characters, years, and the substitutions everyone uses, such as zero for o and three for e, are all recognised. A password that looks complicated but is a common word with predictable substitutions is a password attackers crack first, because their tools try exactly that.

Nothing you type is transmitted, stored or logged. The analysis runs entirely in the page, which is the only honest way to offer this: a strength checker that sends your password to a server is asking you to do the exact thing password advice tells you never to do.

• Entropy in bits with a plain-language rating
• Detects dictionary words, keyboard runs and sequences
• Recognises common character substitutions
• Flags repeated characters and years
• Estimates crack time at several attack speeds
• Character set breakdown
• Nothing transmitted, stored or logged
• Reveal toggle so you can check what you typed

The password strength checker is used by writers, developers, students, marketers and anyone else who needs the job done once without installing software. Common cases include:

• Checking a password before using it somewhere important
• Showing why a password that looks complex is weak
• Comparing a passphrase against a short complex password
• Teaching what actually makes passwords hard to guess
• Reviewing a password policy's assumptions