Password Strength Tester
Measure how long a password would actually survive, scored against four realistic attackers. The password is evaluated in this tab and is never transmitted, logged or stored.
Why most password checkers are the wrong place to put a password
A password is not data you are processing. It is a live credential. The moment it leaves your machine it exists somewhere you do not control — in an access log, in a request body captured by an error tracker, in a CDN cache, in whatever a browser extension decided to observe. Nobody has to be malicious for this to go badly; ordinary infrastructure keeps ordinary records.
Which makes server-side strength checkers an odd artefact. They ask for the one string you should be most careful with, in exchange for a coloured bar that could have been computed locally in a few hundred lines of JavaScript. There is no technical reason the scoring has to happen on a server. This page does it in the tab, which is why you can use it on a password you actually intend to keep.
What the number means
The score is entropy in bits: a measure of how many guesses an attacker must make. Each additional bit doubles that number. It is derived from the size of the character pool the password draws from and its length, and then reduced where the password contains structure that makes it easier to guess than its length suggests.
That last part is where most meters go wrong. Raw entropy assumes every character was chosen at random. Real passwords are not: they are a word, a capital at the front, a year at the back, maybe an exclamation mark. Cracking tools like hashcat never guess character by character — they run word lists through rule sets that capitalise, substitute 0 for o and append junk, which is exactly how people build passwords.
So when this tool recognises one of those shapes, it stops scoring the password as random characters and scores it as what the attacker actually searches: a word from a list, a capitalisation bit, a substitution scheme, and whatever was tacked on the end. Summer2024! looks like 72 bits by length and pool. Scored as a dictionary word with a year and a symbol, it is under 20 — which is why it falls in seconds, and why the tool tells you when it has switched models rather than quietly showing you a green bar.
The same logic runs in both directions. Three or more word-like tokens are scored as a passphrase, which is generous but honest; a password using only two or three distinct characters is scored on its alphabet and length rather than its apparent size, so aaaaaaaaaaaa does not get credit for being twelve characters long.
Reading the crack-time table
A single "time to crack" figure is meaningless without saying who is doing the cracking, so the table shows four. The gap between the top and bottom rows is roughly ten orders of magnitude, and which row applies to you depends entirely on how the site storing your password chose to hash it — something you have no control over and usually no visibility into.
That is the practical argument for length. A password strong enough to survive the bottom row survives every row. One that only survives the top row is relying on a rate limit somebody else configured.
What this tool cannot tell you
It cannot tell you whether your password has appeared in a breach, because finding that out requires sending something derived from it to an API, and this page sends nothing. A perfectly random 60-bit password that leaked in 2019 is worthless despite scoring well here. Entropy measures resistance to guessing, not whether the answer is already published.
It also cannot tell you whether you have reused it. Reuse is the single most common way accounts fall, and no strength meter can see it. Both problems have the same fix: a password manager, generating a different long random string for every site, so that neither memorability nor reuse is ever a factor.
Common questions
Is it safe to type a real password into a website?
Into almost none of them. A strength checker that scores your password on a server has received your password, and it is now in that server's request logs, its error tracker and possibly its analytics. This one never sends it: the scoring runs in JavaScript in your tab, and you can confirm that in the DevTools Network tab before you type a character.
What does “bits of entropy” actually mean?
Each bit doubles the number of guesses an attacker has to make. A 40-bit password takes roughly a trillion guesses to exhaust; a 41-bit one takes two trillion. It is a far more useful number than a coloured bar, because it can be compared directly against how fast a given attacker guesses.
Why does my password lose bits for containing a year or a word?
Because raw entropy assumes every character was chosen at random, and yours were not. Cracking tools do not guess blindly — they run dictionaries through rule sets that append years, capitalise first letters and substitute @ for a. A password matching one of those shapes is found far earlier than its length implies, so the penalty reflects the real search space rather than the theoretical one.
Does this check whether my password has been in a data breach?
No, and that is a deliberate limitation. Every breach-checking service works by sending something derived from your password to an API. Even the careful k-anonymity designs send a hash prefix. This tool sends nothing at all, which means it cannot know about breaches. Use a reputable breach checker separately if you need that, and understand what it transmits.
What is a genuinely strong password?
Length beats complexity. Four or five unrelated words chosen at random — not by you, by dice or a generator — comfortably exceed 60 bits and are far easier to type than a mangled eight character string. Better still, use a password manager so that every password is long, random and used exactly once; then its memorability stops mattering.