Password Strength Checker: test your password instantly

Password Strength Checker estimates how long your password would take to crack by brute force, based on its length and the variety of character types it uses. Rather than matching against a list of "bad passwords," it calculates the total number of possible combinations an attacker would have to try, then divides that by an assumed guessing speed of 10 billion attempts per second — roughly what modern cracking hardware can manage offline.

This password strength checker online shows the result two ways. A colored bar and label give the estimated crack time, from Instant up to Centuries, and a checklist shows which of six common criteria your password meets: at least 8 characters, at least 12 characters, an uppercase letter, a lowercase letter, a number, and a symbol.

How to use this password strength checker tool

Click into the Password box and start typing. The rating and checklist update with every keystroke, so you can watch the estimate grow as you add characters. The password is hidden by default; click Show to see what you've typed and Hide to mask it again. Nothing is submitted anywhere — there isn't even a submit button — so it's safe to test a real password here.

What the crack-time estimate means in practice

The estimate grows with two things: how many characters are in the password, and how large the pool of possible characters is at each position. A password using only lowercase letters draws from a pool of 26; mixing in uppercase brings that to 52, adding numbers brings it to 62, and adding symbols brings it to 95. A longer password drawing from a small pool can still beat a short one drawing from a large pool — which is why length consistently matters more than any single character type.

Why character variety still helps

This estimate assumes every character is unpredictable, but real passwords usually aren't — people reuse the same capitalization patterns, tack a number on the end, or swap a letter for a similar-looking symbol. Mixing character types doesn't just enlarge the mathematical pool; it also breaks you out of the common patterns that password-cracking tools are specifically tuned to try first.

What this checker can't see

Because the checker works out strength from length and character types, it treats every password as if its characters were chosen at random. Real attackers don't guess that way. They start with leaked password lists, dictionary words, names, dates, keyboard sequences like "qwerty", and predictable substitutions like "p@ssw0rd". A password such as "Password123!" ticks every box on the checklist and earns a high rating here, yet it would fall almost immediately to a dictionary attack. Treat the rating as a best case: it tells you how strong the password would be if nothing about it were predictable.

Common weak patterns to avoid

Avoid single dictionary words, even with a number or symbol tacked on the end. Avoid names, birthdays, pet names, and sports teams, which are easy to find on social media. Avoid keyboard walks such as "asdfgh" or "1qaz2wsx", repeated characters, and simple sequences like "abc123". And never reuse a password across sites: if one site is breached, attackers will try the same email and password everywhere else.

What makes the best password strength checker?

A good checker should never send your password anywhere. Any tool that submits it to a server, even over HTTPS, is asking you to trust that it isn't logged. This one runs entirely in your browser, and it keeps working if you disconnect from the internet after the page loads. A good checker should also explain its rating rather than just showing a color, which is why the checklist shows exactly what your password does and doesn't include. Some tools also check passwords against known data breaches; this one deliberately doesn't, because that would mean sending information about your password over the network.

How to make a password stronger

The quickest win is length: adding a few characters does more than swapping a letter for a symbol. A passphrase of four or five random, unrelated words is long, strong, and easier to remember than a jumble of symbols. Better still, let a password manager create and store a unique random password for every account. If you want one right now, ourpassword generatorcreates strong random passwords locally in your browser.

Is it safe to type my real password here?

As far as this page is concerned, yes. The checker is plain JavaScript running in your browser: it reads the password from the box, does the maths on your device, and never sends it anywhere. The field is masked by default, autocomplete is turned off, and nothing is saved when you leave the page. Normal security habits still apply, though — avoid typing important passwords on a shared or public computer, and if you're unsure, test a password that follows the same pattern as your real one instead.

Password strength checker vs. password generator

A checker tells you how strong an existing password is; a generator creates one that's strong from the start. If the checker shows your password is weak, the fastest fix is usually to replace it rather than patch it. A random 16-character password with all four character types lands at the top of the scale here, rated Centuries.

Because checking strength requires looking at the actual password, everything happens locally in your browser; nothing is ever transmitted, logged, or stored.