Password Strength Checker

How to check your password strength

1. Type or paste a password. Use Show to see what you typed.
2. The meter rates it from very weak to very strong and estimates its entropy in bits.
3. The crack-time table shows how long an attacker would need in four realistic situations, from a website that limits login attempts to a stolen database attacked with powerful graphics cards.
4. Read the findings: common passwords, dictionary words, keyboard patterns, repeats and years are all things password crackers try early.

How the estimate works

Simple strength meters just count character types, so they rate P@ssw0rd1! as strong. Real attackers do not guess randomly: they start with leaked password lists, dictionary words with common substitutions (@ for a, 0 for o), names, years and keyboard walks like qwerty. This checker breaks your password into those patterns, scores each part by how many guesses it would take, and uses the smaller of that and the brute-force estimate. A long random password scores highly; a long password made of a word plus a year does not.

Crack times are rough, order-of-magnitude estimates. The biggest factors you control are length and unpredictability. A passphrase of four or five random words is both strong and memorable.

Is it safe to type my password here?

The check runs entirely in your browser; this page sends nothing over the network (it only downloads a public word list). Still, the safest habit is to test a password that is similar in style to yours rather than your real one, and never to reuse passwords. Use a password manager and turn on two-factor authentication for important accounts.