Type a password to see its length, character types, entropy, weak patterns and an illustrative time to guess. Nothing is sent or saved.
A password strength checker estimates how many guesses it would take to find your password, and this one does it in your browser: it counts the length and the character types, looks for common passwords, keyboard walks, sequences, repeats, years and dates, and turns the result into a score from 0 to 4. The score comes from the estimated number of guesses. Under 1 million is Very weak, under 10 billion is Weak, under 100 trillion is Fair, under 1 quintillion is Good, and 1 quintillion or more is Strong. Two rules sit on top: a password with fewer than 8 characters can never score above Weak, and a password that is on the common list is always Very weak. The page opens with a sample so you can see a full result before you type.
Take P@ssw0rd2024. It is 12 characters from four types, so the pool-size method gives 12 x log2(95) = 78.8 bits, which looks strong. The pattern checks see something else: password is second on the list of common passwords, the capital P doubles the guesses, the @ and 0 swaps multiply them by 4, and 2024 is a year, about 200 guesses. That is 2 x 2 x 4 x 200 = 3,200 guesses, or 11.6 bits, and the page rates it Very weak. Compare k9#Vq2$mZx7!, also 12 characters, with no pattern found: it keeps the full 78.8 bits, about 5.4 x 10^23 guesses, and at 10 billion guesses per second that is more than a million years of trying every one.
The pool-size method counts which kinds of characters appear and multiplies: entropy in bits is length x log2(pool). The pool is 26 for lowercase letters, 26 for uppercase, 10 for digits, 33 for the ASCII symbols and the space, and 100 as a rough allowance for any other character. Twelve characters from a pool of 95 give 12 x 6.57 = 78.8 bits. This assumes every character was picked at random, so it is the most a password of that shape can have, never a guarantee. A password a person chose usually has far fewer bits, which is why the page shows a second figure after the pattern checks and rates the lower one.
Each finding comes with a cost. A password on the list costs its position on it. A listed password with look-alike swaps costs that position times 2 for each swap, up to 16, and a capital letter doubles it. A keyboard walk such as qwerty or asdf costs about 80 guesses per key, a sequence such as abcd or 4321 about 52 per character for letters and 20 for digits, a year 200 guesses, and a date 37,200 or 74,400. The estimated guesses are divided by a guessing speed to give the time: 10 billion per second for someone holding a stolen list of fast hashes, or 1,000 per second through a login form. Both speeds are illustrative and the time is for trying every guess of that kind.
The common list holds 997 passwords, so a word that is not on it is not recognised: an ordinary word with a few swaps can be rated higher than it deserves. The page does not look anything up online, so it cannot tell you whether a password appeared in a breach, and it cannot know whether you reuse it elsewhere, which matters more than any score. A score is also not a promise: no result here means a password is safe from all attacks. The text box is not saved and nothing is sent; only the guessing speed you pick is kept on this device. Up to 1,000 characters are checked.
Type it into the box. The page shows a score from 0 to 4, the length, the entropy in bits, a table of weak patterns found and an illustrative time to guess. Try changing one thing at a time, such as adding 4 characters, to see which change moves the score.
Entropy in bits is the length times log2 of the pool size. The pool is 26 for lowercase, 26 for uppercase, 10 for digits and 33 for symbols and the space, added together for the types you used. So 12 characters using all four types is 12 x log2(95) = 78.8 bits. It is an upper bound that assumes random choice.
Because the symbols follow a pattern guessers already try. P@ssw0rd2024 has four character types, but it is the word password with a capital, two look-alike swaps and a year, which comes to about 3,200 guesses instead of 78.8 bits worth. Length and randomness count for more than symbols.
The page divides the estimated guesses by a speed you choose. Eight random lowercase letters are about 2.1 x 10^11 guesses, which is 21 seconds at 10 billion per second. Twelve random characters from all four types are more than a million years at the same speed. Treat these figures as illustrations, not forecasts.
No. The page makes no network request, so it cannot look up breaches. It only compares your password with a built-in list of 997 common passwords. A password that is not on that list can still have been leaked, and one site that was breached makes the same password unsafe everywhere.
No. The text is processed in your browser and not uploaded. The password box is not saved, and the page sends no password text in any request. Only the guessing speed you pick is kept on this device. Even so, testing a similar password, not your real one, is a good habit on any website.