Security Runs locally Ready to use Built-in examples No tracking

Password Strength Checker

Type a password to see its strength level, length, unique characters, charset size, entropy in bits and an offline crack-time estimate, plus risk warnings and suggestions.

To find out whether the password in use would survive a brute-force attack, paste it in: the tool computes information entropy from the character-set size multiplied by the length, reports a level from very weak to very strong, and converts that into an offline crack time at GPU scale — ten billion guesses a second. Three weak patterns — all one character, sequential runs such as abcde or 12345, and excessive repetition — are penalised separately.

Two caveats when reading the result. Very strong refers to exhaustive search only; if the password has already leaked elsewhere or is reused, the level means nothing. And the crack time assumes an offline attack, which is slower against a site storing slow hashes and faster against one storing plaintext or a fast hash. The conclusion never changes: make it longer, stop reusing it, turn on two-factor authentication.

—
—
—
—
—
—

How to use

  1. Type or paste the password.
  2. Read the strength level, the charset size and the entropy in bits.
  3. Check the crack-time estimate and any pattern warnings.
  4. Act on the suggestions: longer, unique, and with two-factor authentication.

How it works

How the score is computed

First compute the character-pool size C actually used and the length L, giving entropy = L × log2(C) in bits. Three detectable weak patterns then discount it: all characters identical → entropy collapses to a single character's worth; a consecutive sequence (abcde, 12345) → counted by start point and length only; fewer than half the characters unique → entropy × 0.6. Tiers by entropy: under 28 very weak, under 36 weak, under 60 moderate, under 80 strong, 80+ very strong.

Character classes and pool size

Pool size accumulates by the classes actually present: lowercase 26, uppercase 26, digits 10, printable ASCII symbols 33, plus a conservative 100 for non-ASCII characters like Chinese; whitespace-only/control-character input counts as 10. This is why "8 digits" has a vastly smaller search space than "8 mixed letters and digits" — the basis for judging whether lengthening or adding classes helps more.

Reading the risk warnings

Risk warnings name the concrete problem (too short, all identical, consecutive, too many repeats); improvement tips give the next action (lengthen past 12, add lowercase/uppercase/digits/symbols). Both are advisory and don't alter the computed numbers.

How crack time is estimated

Crack time assumes offline brute force at 10^10 guesses per second (GPU scale), averaging half the search space, then converts to readable years/days/hours/minutes/seconds. If the password already appears in a public breach dump, real cracking is far faster — "very strong" never justifies cross-site reuse.

Estimation method: entropy = character-set size ^ length, discounted for three weak patterns (all-identical characters, sequential runs, excessive repetition). Crack time assumes 1e10 offline guesses per second (GPU-class) and the average of half the key space. No weak-password dictionary lookup.

Code example

JavaScript A rough entropy estimate 

// Entropy = length × log2(pool size), same rule as this tool
const pool = (/[a-z]/.test(pw) ? 26 : 0) + (/[A-Z]/.test(pw) ? 26 : 0) +
             (/[0-9]/.test(pw) ? 10 : 0) + (/[^a-zA-Z0-9]/.test(pw) ? 33 : 0);
const entropy = pw.length * Math.log2(pool);
console.log(entropy.toFixed(1), "bit");  // 60+ is strong, 80+ is very strong

Python A more realistic estimate with zxcvbn 

# pip install zxcvbn: ships dictionaries and pattern matching, more accurate than raw entropy
from zxcvbn import zxcvbn

r = zxcvbn("mypassword2019")
print(r["score"])  # 0 to 4, 4 is strongest
print(r["crack_times_display"]["offline_slow_hashing_1e4_per_second"])

FAQ

Is my password uploaded or saved?

No. Everything computes in the browser: the password isn't uploaded, isn't written to localStorage, and never enters access logs. This tool deliberately has no history section — close or refresh the page and it's gone.

Why not check against a weak-password dictionary?

Dictionaries need constant maintenance and non-trivial size, conflicting with "fully local, works offline". This tool uses entropy plus three detectable weak patterns; if your password is a common word or a leaked one, its real strength is below the displayed tier.

Why do equal-length passwords differ so much in strength?

Entropy is pool size × length: 8 digits draw from a pool of 10 (~27 bits), while 8 letters mixed-case plus digits draw from 62 (~47 bits) — a search space difference of millions of times.

Are Chinese characters in passwords safer?

The estimate credits each non-ASCII character with a conservative pool of 100, so same-length Chinese passwords score higher entropy. But support across systems is inconsistent, and input-method suggestions can leak them — don't rely on Chinese characters alone.

Does "very strong" mean bulletproof?

No. The estimate covers brute-force search space only — not whether the password is in a breach dump, reused across sites, or stolen by keyloggers or phishing. What actually works: long enough, never reused, plus two-factor authentication.

Why do sequences and repeats get penalized so heavily?

Attackers try dictionary and keyboard patterns first. abcde, 123456789 and aaaaaaaa have far smaller effective search spaces than random strings of the same length, so the estimate counts them by "start + length" or as a single character.

What does a crack time of "instant" mean?

That at 10^10 offline guesses per second the entire space is exhausted in under a second. Such passwords should be changed immediately on every site they touch.

How long should my password be?

For general use, 12+ characters across at least three classes; for critical accounts (email, banking, master password), 16+ — or simply use a random string from the password generator, unique per site.