Password Strength Checker
Check how strong a password is and get concrete ways to improve it. The password is analysed inside your browser and never leaves your device.
- Not met At least 12 characters
- Not met Lowercase letter (a-z)
- Not met Uppercase letter (A-Z)
- Not met Number (0-9)
- Not met Symbol (!@#$...)
What this password strength checker does
It measures the length and the character variety of a password, looks for the patterns attackers try first, and turns that into a score, a checklist and a list of concrete fixes. The whole analysis happens in your browser, so the password never leaves your device — which is the only honest way to build a tool like this.
How the score is calculated
Length comes first: the thresholds are 8, 12, 16 and 20 characters, and nothing below 12 is rated above “Fair”. On top of that we count how many kinds of character are present — lowercase, uppercase, numbers and symbols. Then the penalties apply, and they are what keeps the score honest: a password from a public breach list, a common word wearing a disguise, a repeated character or a run such as 1234 is capped no matter how long it is.
Tips for stronger passwords
Length beats complexity: four ordinary words joined together are harder to crack than eight characters of punctuation, and far easier to type. Never reuse a password between sites — a breach at one becomes a break-in at every other. Use a password manager so every account can have a long, unique password you never have to remember, and turn on two-factor authentication wherever it is offered.
How to check a password
Type a password to get an instant score and checklist.
- Type or paste the password into the field.
- Read the score, the checklist and the suggestions.
- Adjust the password and watch the score move until it is strong.
FAQ
Does this tool upload my password?
No. Everything runs in your browser: the password is never sent over the network, never stored, and never written to the page address.
Should I type a password I actually use?
The analysis is local, so nothing is transmitted. Even so, the safest habit is to test a variation rather than the real thing — and if a password you use scores badly here, change it.
What length is considered strong?
Twelve characters is the floor and sixteen or more is better for email, banking and anything that can reset other accounts.
Do I need symbols?
They help, but length and uniqueness matter far more. A long passphrase with no symbols beats a short password full of them.
How is the crack time estimated?
From the size of the search space, assuming an attacker who has stolen the password file and guesses about ten billion times per second on a GPU. It is the worst realistic case; a site that stores passwords properly slows that down by many orders of magnitude.
Wikipedia — Password strength
Wikipedia — Password cracking
Wikipedia — Entropy
Wikipedia — Passphrase
Wikipedia — Dictionary attack
Wikipedia — Password manager