Your password never leaves your browser and is never uploaded or stored.
Type a password above to see its strength, estimated entropy and suggestions.
Help
About this tool
Type a password and see how strong it is. The checker estimates character-set entropy from the character types you use, then discounts common passwords, dictionary words, repeated characters and sequences such as abc, 123 or qwer. You get a five-level rating, an entropy estimate, a crack-time figure based on a stated offline attack rate and a short list of concrete improvements. Everything is computed locally in your browser: the password is never uploaded, never stored and never sent anywhere. This tool is a guide, not a substitute for a password manager.
How to use
- Type or paste a password into the field, and use the eye button to reveal or hide it.
- Read the strength bar, the estimated entropy and the crack-time estimate as you type.
- Follow the suggestions to make the password longer and more varied, and copy just the suggestions if you want.
How is the strength estimated?
Two steps. First the checker estimates entropy from the character set: it looks at whether you use lowercase, uppercase, digits, symbols or non-ASCII characters, sums the size of those sets into a pool N, and estimates entropy as length times log2(N) bits. Then it applies discounts for weak patterns — a built-in list of common passwords and dictionary words (including case and character-swap variants), runs such as abc, 123 or qwer, repeated characters like aaa, and all-digit passwords. The remaining effective entropy drives the five-level rating.
What are the assumptions behind the crack time?
Crack time is the time to exhaust the effective keyspace at an assumed offline attack rate of about 10^10 guesses per second, a reasonable order of magnitude for a well-optimised attacker against a fast hash. It is a rough magnitude, not a guarantee: a slow password hash, rate limiting or a different attack model such as guessing weak passwords first changes the real number by many orders of magnitude.
Is the password uploaded or stored?
No. The password is evaluated entirely in your browser and never leaves your device. It is not sent to any server, not written to localStorage, sessionStorage, cookies or IndexedDB, and not added to the URL. Closing or reloading the page discards it.
Why can this tool not replace a password manager?
A strength checker can only judge the shape of the single password you type; it cannot enforce uniqueness, warn you about passwords exposed in breaches, or fill credentials for you. Reusing a password that looks strong is still dangerous. Use a password manager to generate and store a unique password per account, and use this checker as a quick sanity check while typing.