Why password strength matters
Weak passwords are behind the majority of account breaches. This free password strength checker estimates how long it would take a modern attacker to crack your password using its entropy — a mathematical measure of unpredictability. The higher the bits of entropy, the exponentially harder it is to guess.
How to create a strong password
Aim for at least 12–16 characters mixing uppercase, lowercase, numbers, and symbols — or better still, use a long passphrase of random words. Never reuse passwords across sites. For the safest approach, pair this tool with a password manager (see our best password manager guide).
Is this password checker safe?
Completely. Every calculation runs locally in your browser using JavaScript. Your password is never transmitted, logged, or stored on any server. You can even disconnect from the internet and it still works.
How password strength is actually measured
Strength is not a vibe, and it is not the coloured bar most signup forms show you. It is entropy, measured in bits, and it has a formula. If N is the size of the character set your password draws from and L is its length, then entropy = L × log2(N). Each additional bit doubles the number of guesses an attacker must make.
The character sets in practice: lowercase only is 26 characters, giving about 4.7 bits per character. Adding uppercase takes it to 52 characters and 5.7 bits. Adding digits reaches 62 characters and 5.95 bits. Adding common symbols brings it to roughly 95 characters and about 6.57 bits per character.
Work that through and the results are counterintuitive. An eight-character lowercase password carries about 37 bits. A sixteen-character password using the full symbol set carries about 105 bits. Four genuinely random words drawn from a 7,776-word list carry about 51.7 bits — more than the eight-character password with all four character types, and vastly easier to remember.
Why crack-time estimates vary so wildly between tools
Any tool quoting a single crack time is hiding an assumption, because the answer depends entirely on how the password is stored at the other end. An online login form with rate limiting might allow a hundred attempts per second. An offline attack against a database of unsalted MD5 hashes on modern GPU hardware runs at billions of guesses per second. The same password can look uncrackable under the first assumption and trivial under the second.
This matters more than password composition rules do. If a service stores your password badly, no realistic password saves you. If it stores it well — using a deliberately slow algorithm such as bcrypt, scrypt or Argon2 — then even a moderate password holds up, because the algorithm caps how fast guesses can be tested.
Length beats complexity, and it is not close
Substituting characters — a zero for an O, a 3 for an E, an exclamation mark on the end — adds almost nothing. Attackers have been applying those exact substitution rules automatically for over two decades. A cracking rule set turns Password into P@ssw0rd! in microseconds because that transformation is in every wordlist mangling ruleset ever published.
Adding length adds entropy that no rule set can shortcut. This is why passphrase approaches work: four or five unrelated words are longer, more memorable, and harder to attack than a short string tortured into looking complex.
Frequently asked questions
Is it safe to type my real password into this tool?
Yes. Every calculation runs in JavaScript inside your browser. Nothing is transmitted, logged or stored, there is no server call at any point, and you can disconnect from the internet after the page loads and the tool still works. That said, the safest habit with any online checker is to test a password of the same length and composition rather than the exact one you use.
What is a good entropy score to aim for?
As a working guide, under 40 bits is weak against any determined attack, 60 to 80 bits is reasonable for ordinary accounts, and above 100 bits is appropriate for password manager master passwords, encryption keys and anything protecting other credentials.
Why does my password score badly when it has symbols and numbers?
Almost certainly because it is short, or because it is built on a dictionary word with predictable substitutions. Entropy scales with length, and pattern detection discounts sequences an attacker would try early. A twelve-character random string will usually beat an eight-character one loaded with symbols.
Are password managers safer than memorising passwords?
For most people, yes, because the alternative in practice is reuse. Reuse is the single most exploited weakness there is: one breached site exposes every account sharing that password. A manager lets every account have a long unique password you never need to recall. See our password manager comparison.
Should I change my passwords regularly?
Forced periodic rotation is no longer recommended by NIST, because it pushes people toward predictable increments such as appending a number that climbs each quarter. Change a password when there is a reason to: a breach notification, a shared credential, or any suspicion of compromise.