Password Strength Checker

Security engineers auditing an internal password policy, developers deciding whether a staging credential is safe enough to commit to a secrets manager, and everyday users who just got a breach notification all face the same question. Is this password actually strong, or does it just look strong because it has an exclamation point on the end?

This checker scores any password from zero to four, estimates its entropy, and models how long it survives four realistic attack scenarios from throttled online guessing to GPU-accelerated offline cracking. It also detects common base words, keyboard walks, and dates, then suggests the specific fix. Everything runs in the tab, so the password never leaves the machine.

How the strength scoring works

Entropy starts from the classic length times log base two of the pool size calculation, where the pool grows as the password uses lowercase, uppercase, digits, and symbols. Raw pool math alone overstates real-world strength, so the estimator applies multipliers for structure it can detect. Keyboard runs such as qwerty, straight alphabet or digit sequences, and long repeats of one character each cut the estimate, because password crackers try those patterns before random guessing.

A bundled wordlist of several hundred breached passwords is checked twice, once as typed and once after a leetspeak normalization step that maps substitutions like at sign for a and zero for o back to their base letters. A hit on that list caps the entropy estimate at eight bits regardless of length, which is the correct behavior because such passwords sit at the very front of every cracking dictionary. Date-like substrings such as four digit years receive a further haircut since birth years are among the first guesses tried against a known username.

The entropy figure is converted to a guessing-log scale and mapped to the zero through four score bands. Crack times are derived by dividing the guess space by each scenario throughput, then rendered in human units from instants to centuries. The check list and warning messages are produced from the same pattern detectors, so the advice you see always matches the number in the meter.

Nothing is transmitted. The scoring functions and the breach wordlist are bundled into the page JavaScript, so the password you type is evaluated in local memory and discarded when the tab closes.

Before and after: a typical reused password

Input, a password someone might reuse across a few sites:

Password1

Output, the score and the reason behind it:

score:       0 / 4  (very weak)
entropy:     8 bits (capped, wordlist hit)
crack (throttled online):   instantly
crack (offline fast hash):  instantly

warnings:
  appears in known breach wordlists

fix: replace with a four-word random passphrase
     or generate a 16+ character random string

The same checker scores a four-word passphrase such as correct horse battery staple! at score four with roughly 171 bits of entropy and crack times measured in centuries across all four scenarios, which is the target for any account you care about.

Who checks passwords with this tool

Common mistakes when judging password strength

• Adding a digit and symbol to a dictionary word. Password1 and Summer2024! both start from a base word that sits near the top of every cracking dictionary, and appending predictable characters only adds a couple of guesses. The checker flags the wordlist hit and caps the entropy, which is why the score stays at zero no matter how many symbols are tacked on.
• Trusting length alone when the characters are a keyboard run. Qwertyuiop is ten characters long but follows a single row of the keyboard, so an attacker only needs one pattern rule to cover it. The sequence detector catches runs of four or more consecutive keys and slashes the entropy estimate accordingly.
• Reusing the same strong password everywhere. A password that scores four is only safe if the site storing it hashes it properly, and a breach at any one service exposes the credential everywhere else it was reused. Generate a unique password per service and let a password manager hold them.
• Ignoring the offline fast hash scenario. A password that survives online throttling can still fall in minutes if the site stored an MD5 or SHA-1 hash and the database leaks. Check the fast hash row before assuming a moderate score is good enough for an account with a long password lifetime.

Best practices for password strength workflows

• 1.Use a random passphrase of four or more unrelated words for anything you must memorize, and check it here until it clears score four.
• 2.Generate completely random sixteen character strings for accounts you never need to type by hand, and store them in a password manager.
• 3.Treat a score of zero as a hard stop. If the warnings name a wordlist hit or a keyboard walk, replace the password rather than tweaking it.
• 4.Pair strong passwords with hardware keys or TOTP two-factor codes, because strength alone does not stop phishing that relays a live login.

Frequently asked questions