Password strength checker
GeneratorsNo. 47 / 84
Analyze a password's length, character mix, entropy and estimated crack time without it leaving your browser.
the meter does the judging; the password never leaves the room.
work surface
Math, not advice — results are indicative.Read the disclaimer.
most-used utilities
Compare two candidates
Type one, note the bits, swap in another, and pick the one with more room before it hits a wall.
Audit an old favorite
Run the password you have used since 2014 and see exactly why it deserves retirement.
Explain bits to a colleague
Show the jump in crack time when length goes from eight to sixteen characters, minus the lecture.
pro tips
Length buys more than punctuation. Twelve random characters beat eight clever ones, and both lose to sixteen.
A password that has appeared in a breach is weak no matter what the meter says. Change it; the meter cannot see the leak.
If the estimate looks flattering, check the pattern. Long strings of repeated characters and keyboard walks fool people, not guessing rigs.
what it does
Type or paste a password and the page breaks it down: how long it is, which character classes it uses, how many bits of entropy the raw math gives it, and how long an offline guessing rig would need. The field stays masked until you ask to see it, and no copy of the password is kept anywhere.
Entropy is measured in bits, and each extra bit doubles the number of guesses required. The estimate takes the size of the character pool, multiplies it across the length, then knocks the result down for common words, repeated characters, keyboard runs and years. It is a rough model, not a verdict from a security auditor with a clipboard.
The crack time assumes a serious offline setup trying around ten billion guesses per second against a stolen hash. Online logins are slower, which is why rate limits matter, but the ranking between two passwords holds. Anything past a few centuries is already beyond casual interest.
Suggestions appear under the numbers and change as you type: add length, widen the character mix, drop the word that appears in every leaked list. Use the result to pick better passwords and, more importantly, to stop reusing the same one everywhere.
quick answers
Is my password sent anywhere?
No. The analysis runs in the page with local JavaScript; nothing is uploaded, logged or saved, and there is no request behind the numbers. Close the tab and the value is gone.
What does entropy in bits mean?
It is the base-two logarithm of how many combinations an attacker would have to try. One more bit doubles the work, so the gap between 40 and 60 bits is not twenty percent, it is a million times.
Why is the crack time only an estimate?
It assumes random characters and a fixed guessing speed. Real passwords contain words, dates and habits, and real attacks start with dictionaries before brute force, so treat the number as a rough ranking rather than a promise.