Password Strength Checker

Type a password to see how strong it is and roughly how long it would take to crack in four situations, from an online login that limits attempts to an offline attack on a stolen database using fast graphics cards. The checker looks for the patterns attackers try first, such as common passwords, dictionary words with letter substitutions, keyboard runs, years and the familiar capital-word-number-symbol shape, and explains each weakness it finds.

The check runs entirely in your browser. Your password is not stored, sent anywhere or added to share links.

Entropy (bits) = length × log₂(character set size)

Average guesses to crack = 2^bits ÷ 2; time = guesses ÷ guesses per second

A random password drawn from 95 printable characters gains about 6.6 bits per character. Real passwords are rarely random, so the checker reduces the estimate when it finds predictable pieces. The crack rates are illustrative: rate-limited online attacks are very slow, while offline attacks on fast, unsalted hashes can try billions of guesses a second on modern hardware.

Summer2024! has 11 characters and all four character types, yet it rates fair because it follows the most common pattern: a capitalized word, a year and a symbol.

correct horse battery staple, the four-word passphrase made famous by the xkcd comic, rates very strong because of its length, even though it uses only lowercase letters and spaces. Truly random words matter: a phrase from a song or quote is much weaker.

• Length first. NIST Special Publication 800-63B asks for at least 15 characters when a password is the only sign-in factor, and at least 8 with multi-factor authentication.
• No forced complexity or regular changes. NIST advises against rules like "must include a symbol" and against routine expiry, which lead to predictable patterns.
• Block known breached passwords. Services should reject passwords found in breach lists.
• Use a password manager to create and store a different random password for every account.
• Turn on multi-factor authentication, ideally with an authenticator app or passkey.

For the few passwords you must remember, such as your computer login or password manager, a passphrase works well. Pick four to six words at random, ideally by rolling dice against a word list or using a generator rather than choosing words yourself, since people tend to pick related or popular words. Join them with spaces or hyphens. Six random words from a 7,776-word list give about 77 bits of entropy, enough to resist offline attacks for a very long time, and they are far easier to type than a string of symbols.

No meter can know whether a password has already leaked or is reused elsewhere, and reuse is the most common way accounts are taken over. A strong password also does not protect you from phishing, where you type it into a fake site. Treat the result as a guide: if a password is personal, guessable from your social media, or used on more than one site, change it regardless of its score.