Password Strength Test
Instantly analyze the strength of any password. Our checker measures entropy, detects common patterns, and estimates how long a brute-force attack would take. Your password is never stored or transmitted to third parties.
What Makes a Password Strong?
Password strength is primarily determined by entropy - A measure of unpredictability. The higher the entropy, the more guesses an attacker needs on average. Entropy is calculated from the character set size and password length. Our explainer on password entropy covers exactly how those bits are calculated.
Strength by Character Set
Strong Password Checklist
If your password misses any of these points, follow our step-by-step guide on how to create a strong password.
- At least 12 characters long (16+ recommended)
- Contains uppercase and lowercase letters
- Includes numbers and special characters
- Not based on dictionary words or names
- Not reused from any other account
- Does not follow keyboard patterns (qwerty, 123456)
- Not derived from personal information (birthdate, name)
Entropy Reference Table
| Entropy (bits) | Strength | Recommended For |
|---|---|---|
| < 28 | Very Weak | Not recommended for any use |
| 28 – 35 | Weak | Low-value, temporary accounts only |
| 36 – 59 | Moderate | Non-critical personal accounts |
| 60 – 127 | Strong | Most online accounts and services |
| 128+ | Very Strong | Encryption keys, critical systems |
What the Crack-Time Estimate Really Means
Any crack-time figure is a model, not a measurement, and it changes completely depending on how the password is stored by the service you are using it on.
| Scenario | Guesses per second | Effect on the estimate |
|---|---|---|
| Online login with rate limiting | A few per minute | Even a weak password survives a long time - the lockout does the work |
| Offline attack, bcrypt / Argon2 hash | Thousands | Deliberately slow hashing keeps a decent password out of reach |
| Offline attack, fast hash (MD5, unsalted SHA-1) | Billions | Anything short falls in minutes regardless of character variety |
You do not get to choose which of these applies - the service does, and it will not tell you. Assume the worst case and pick length accordingly.
Why Length Beats Complexity
Adding one character to a password multiplies the search space by the size of the character set. Adding a symbol to a short password merely widens that set once. The arithmetic favours length overwhelmingly, which is why NIST SP 800-63B dropped mandatory composition rules and recommends allowing long passphrases instead.
- A four-word passphrase drawn from a large word list beats a shorter string with substitutions, and is far easier to type on a phone.
- Predictable substitutions - a to @, o to 0, i to 1 - add essentially nothing, because every cracking tool applies those transformations automatically.
- Appending a digit and an exclamation mark to satisfy a composition rule is the most predictable pattern of all.
What This Checker Cannot See
A strength score measures unpredictability in isolation. It cannot know whether the password has already appeared in a breach corpus, whether you have reused it elsewhere, or whether it is a phrase strongly associated with you personally. A long, high-scoring password that has already leaked is worthless. Check it against known breaches, and treat uniqueness as a separate requirement from strength.
Frequently Asked Questions
The password is submitted in a standard HTML form POST over HTTPS. It is analyzed in memory and immediately discarded - It is never written to a database, log file, or any storage.
Aim for a score of 3 or 4. A score of 4 (60+ bits of entropy) means the password would take years to crack even with offline GPU attacks. For financial or health accounts, always use score 4.
Length helps, but predictable patterns (like repeating words or sequences) reduce effective entropy. Our analyzer detects common patterns and adjusts the score accordingly. A truly random 12-character password beats a 20-character dictionary phrase.
A passphrase is a string of random words (e.g. correct-horse-battery-staple). Four or more random words from a large wordlist can achieve 50+ bits of entropy - Strong enough for most uses, and much easier to remember than a random character string.
Related Tools
Sources & Further Reading
The technical claims on this page are drawn from the primary specifications and vendor documentation below.