Password Strength Checker

Type a password and this page estimates its entropy in this tab only. The text is never sent to a server, saved, or written to any log or analytics — there are no analytics on this page at all — and the checker works with the network cable pulled. Treat the result as a rough estimate: it starts from length × log₂(character pool) and subtracts published, itemized penalties for the patterns cracking tools try first. It cannot know whether your password has already appeared in a data breach.

Password to check (stays on this device; use a throwaway variant if you prefer)

Show password only do this somewhere private

–

estimated bits of entropy, after pattern penalties

Length–
Character pool (estimated)–
Base entropy before penalties–
Pattern penalties–
Avg. crack time @ 10 billion guesses/sec (fast-hash model)–

How this estimate works

The base figure assumes the password was drawn uniformly from the character pool its characters imply — lowercase present means a pool of 26, uppercase adds 26, digits 10, symbols 32. Real human passwords are not drawn uniformly, which is what the penalties are for:

Common words and passwords (−25 bits): matched against a built-in list of the passwords and words that appear in every breach corpus, including leetspeak spellings like p@ssw0rd.
Sequences (−4 bits per character beyond two): keyboard walks (qwerty, 1qaz-style runs along the rows), alphabet runs and digit runs, forwards or backwards.
Repeats (−3 bits per extra repeated character): aaa and friends add length on paper and very little work for a cracker.
Years (−6 bits): any 19xx or 20xx run; birth years and anniversaries are in every rule set.

The crack-time line uses the same stated model as the generator: an average of half the remaining space at 10 billion guesses per second against a fast, unsalted hash. Against a slow salted hash (bcrypt, Argon2) times stretch by orders of magnitude; against a password that has already leaked, no estimate matters — it is found by lookup, not by guessing.

The honest limit of every strength checker, including this one: an estimate describes a password's shape, not its history. A long, high-scoring password that you also used on a forum in 2016 is weak in the way that counts. Unique per account, stored in a password manager, is what actually protects you. If this checker scores something poorly, replace it with a generated password or a generated passphrase rather than decorating it by hand.

FAQ

Is it safe to type a real password here?

The check runs entirely in your browser's JavaScript; the page makes no network request with your input, stores nothing, and loads no third-party scripts. You can verify that in your browser's network tab, or disconnect and reload — it still works. If you would rather not type a live password anywhere, change a couple of characters first; the estimate will be nearly identical.

Why did my long password score low?

Almost always one of the itemized penalties: a common word inside it, a keyboard walk, repeats, or a year. The notes under the result name the specific deductions.

Why did a short random password score well per character?

Random characters carry full entropy — about 6.55 bits each from the full printable set — but length still caps the total. Twelve random characters (≈78 bits) beat twenty predictable ones, and the estimate reflects that.

Does a high score mean I can reuse this password?

No. The score knows nothing about reuse or breaches. One password, one account.