Real entropy, in bits
Strength is measured as the size of the search space an attacker must cover, expressed in bits. Each extra bit doubles the work. That is the number security professionals actually use.
Security Tool
Password Strength Checker
Test how strong your password really is. This checker measures true entropy, detects the patterns attackers try first — dictionary words, keyboard runs, dates, leetspeak swaps — and estimates how long it would survive four different kinds of attack. Nothing you type is sent anywhere.
- ✓ Runs offline in your browser
- ✓ Never transmitted or stored
- ✓ Real entropy, not a colour bar
- ✓ Free, no sign-up
Check a password
Type or paste below. The analysis happens on your device — the password never leaves this page, is never logged, and disappears when you close the tab.
Waiting for input
Offline attack estimate appears here
Length0Characters typed
Entropy0 bitsAfter pattern penalties
Character pool0Possible symbols per position
Unique characters0Repetition weakens a password
- 12+ characters
- Lowercase
- Uppercase
- Numbers
- Symbols
- No obvious pattern
Estimated time to crack
| Attack scenario | Guess rate | Time to crack | Verdict |
|---|
Times assume an attacker must search half the keyspace on average. Where a password matches a known list or an obvious pattern, the estimate reflects the pattern — not the raw character count — because that is how real cracking software works.
A strength checker that thinks like an attacker
Most password meters count character types and hand out points. That model rates P@ssw0rd1 as strong when it is one of the first guesses any cracking tool makes. This one scores the way real attacks work.
Pattern detection
Dictionary words, names, keyboard runs like qwerty and asdf, ascending sequences, repeated blocks, years and dates are all detected and penalised, because cracking tools try them first.
Leetspeak is not a disguise
Swapping a for 4 and o for 0 adds almost nothing. The checker normalises those substitutions before matching, so you get an honest score rather than a flattering one.
Four attack scenarios
A password that survives a throttled login form can fall in seconds to a GPU rig with a leaked hash. You see both, plus the two cases in between, instead of one meaningless number.
Nothing leaves your device
No network request is made at any point. There is no upload, no logging and no analytics on what you type — which is the only acceptable design for a tool that handles passwords.
Specific, actionable fixes
Instead of a vague nudge, you get the exact reason a password is weak and the change that would help most — usually length rather than another symbol.
How to check your password strength
The whole test takes a few seconds and updates as you type.
- Type or paste a passwordUse the show button if you want to see it. Nothing is transmitted, so it is safe to test a password you actually use — though testing a close variant is a sensible habit on any site.
- Read the meter and the entropyThe five segments give a quick verdict, but the entropy figure is the real measure. Under 40 bits is weak, 60 to 80 is solid for most accounts, and above 100 bits is effectively unbreakable.
- Fix what the warnings flagEach warning names a specific weakness. Address the red ones first — a detected dictionary word or common password matters far more than a missing symbol.
- Compare the attack scenariosIf your password only survives the throttled scenario, it depends entirely on the website defending you. Aim for something that holds up in the offline fast-hash row.
How password strength is actually measured
Two passwords with the same length and character mix can differ in strength by a factor of billions. Here is why.
Entropy and the search space
Raw entropy is bits = length × log₂(pool size). A ten-character password drawn from all 95 printable ASCII characters carries about 65 bits, meaning roughly 36 quintillion possibilities.
Every additional bit doubles the attacker's work, which is why length beats complexity: adding one character multiplies the search space, while adding one symbol type only widens the pool slightly.
Why the raw figure lies
That formula assumes every character is chosen at random. Human passwords are not random, so real cracking tools never brute-force blindly. They start with leaked password lists, then dictionaries, then dictionaries with predictable mutations applied.
Against that approach a password like Summer2024! falls in moments despite scoring well on a naive meter. This checker applies penalties for exactly those patterns.
The four attack scenarios
An online throttled attack is limited by the site to a handful of attempts per second. An unthrottled one against a poorly built login might manage thousands.
Once a database is stolen, everything changes. A password stored with a slow hash such as bcrypt or Argon2 resists tens of thousands of guesses per second, while one stored with plain MD5 or SHA-1 falls to consumer GPUs at hundreds of billions per second.
What a strong password looks like
Four or five unrelated words give roughly 50 to 65 bits and are far easier to remember than a short string of symbols. Add length rather than complexity if you need more.
Better still, let a password manager generate 20 random characters per site. You never need to remember or type them, and reuse — the single biggest real-world risk — becomes impossible.
Habits that matter more than the score
A perfect password on one account will not save you if the same one protects five others.
- Never reuse a password. Credential stuffing takes a password leaked from one breached site and tries it everywhere else. Reuse turns one breach into many.
- Protect your email above everything. Whoever controls your inbox can reset the password on almost every other account you own.
- Turn on two-factor authentication. Even a cracked password is usually useless without the second factor.
- Length beats symbols. A sixteen-character passphrase of ordinary words outlasts an eight-character string of punctuation.
- Stop scheduled rotation. Forcing changes every ninety days pushes people toward predictable increments. Change a password when there is a reason to.
- Treat security questions as passwords. Your mother's maiden name is public information. Store a random answer in your password manager instead.
Where to go next
Generate replacements with the password generator, then store them properly — here is why a password manager is worth it and how two-factor authentication works.
For the wider picture, read our guides on protecting your online privacy, spotting a phishing email and opting out of data brokers.
Password strength FAQs
What people ask before trusting a password checker.
This tool makes no network requests at all — the analysis runs entirely in your browser, nothing is logged, and the value disappears when you close the tab. You can verify that by opening your browser's network tab while typing. That said, treating any password as secret is a good instinct, so testing a close variant rather than the exact string is a reasonable habit on any website.
For an important account, aim for at least 16 characters and around 75 bits of entropy or more. Four to five random unrelated words achieve this and are easy to remember. For anything you store in a password manager, use 20 or more random characters, since you never have to type it from memory. Anything under 12 characters should be considered temporary regardless of how many symbols it contains.
Twelve characters is the practical minimum, sixteen is a good default, and twenty or more is appropriate for email, banking and password manager master passwords. Length is the single most effective variable: each extra character multiplies the search space, whereas adding one more symbol type only widens the pool from around 62 possibilities to 95.
For anything you must remember, yes. Five randomly chosen words give roughly 60 to 65 bits of entropy, comparable to a ten-character random string, but you can actually recall it. The critical word is random: words you pick yourself, or a phrase from a song or book, are far weaker because attackers use exactly those sources as dictionaries.
Barely. Leetspeak substitutions such as a to 4, e to 3, o to 0 and s to $ are built into every serious cracking tool as standard mutation rules. Turning password into p4ssw0rd adds a rounding error's worth of difficulty. This checker reverses those substitutions before matching against its pattern lists, which is why such passwords score honestly here.
Only when there is a reason: a breach notification, a shared password, a suspicious login, or a password you know is weak. Current guidance from NIST and the UK's National Cyber Security Centre advises against scheduled expiry, because forced routine changes push people toward small predictable edits such as adding a number at the end — which attackers model easily.
It is a measure of unpredictability. A password with 40 bits of entropy has about a trillion possibilities; one with 80 bits has about a septillion. Each additional bit doubles the number of guesses required. Under 40 bits is weak against any serious attacker, 60 to 80 bits is comfortable for most accounts, and above 100 bits is beyond the reach of any foreseeable hardware.
Many sites enforce composition rules — one uppercase, one number, one symbol, and sometimes a maximum length — that have little to do with actual strength. A 30-character passphrase of plain words is genuinely stronger than the eight-character string those rules produce, but it may still fail their validation. Add a digit and a symbol to satisfy the form; it will not weaken anything.
Find the weak ones before someone else does
Test the passwords guarding your email, your bank and your password manager. Those three protect everything else you own.
Crack-time figures are estimates based on published guess rates for common hashing algorithms and hardware. They illustrate relative strength rather than predicting any specific attack. No password checker can tell you whether a password has already appeared in a breach — for that, use a password manager with breach monitoring built in.