Password strength checker
This password strength checker estimates how hard a password would be to guess and explains what makes it weak. It is for anyone choosing a new password who wants a quick, private check first.
- Runs in your browser
- Free, no account needed
- Copy or download the result
Result
Example
Summer2024!
Rating: Very weak Estimated strength: about 23 bits (rough estimate) Length: 11 characters Character types: lowercase letters, uppercase letters, digits, ASCII symbols or spaces (pool of 95) Upper bound from length and pool: 72 bits Patterns found: - common password or word "summer" - year "2024" Rough time to guess, as an order of magnitude (half the guesses on average): Online with rate limiting, 100 guesses per second: hours Offline, slow hash such as bcrypt, 10 thousand guesses per second: minutes Offline, fast unsalted hash on GPUs, 10 billion guesses per second: under a second Advice: - Use at least 12 to 16 characters. Extra length adds more strength than swapping in symbols. - Avoid predictable parts such as common words, years, repeats, sequences and keyboard paths. - Use a different password for every account; a password manager makes that practical. - Turn on two-factor authentication where it is offered. Checked locally in your browser. Nothing is sent anywhere. Assumes the attacker tries common passwords and patterns first. Real guessing tools differ, so treat these as rough ranges, not precise times.
How to use the password strength checker
- Type a password into the Password to check box.
- Press Run.
- Read the rating, the patterns found and the advice.
- Press Reset to clear the box when you are done.
How it works
The starting estimate is the length times the bits for the character pool used: 26 lowercase, 26 uppercase, 10 digits, 33 ASCII symbols and space, and 100 for any other characters.
The estimate is then lowered for things attackers try early: a built-in list of 200 very common passwords, common words with look-alike swaps, years, repeats, sequences like abc or 123, keyboard paths like qwerty, and passphrases of plain words.
Guess times assume half of the possibilities are tried on average at 100, 10 thousand and 10 billion guesses per second, and are shown only as an order of magnitude.
The check runs in your browser, and the password is not sent or stored.
Everything runs in your browser. Your input is not uploaded or stored.
Questions and answers
Is it safe to type my password here?
The check runs entirely in your browser and nothing is sent anywhere. Even so, it is good practice to test a similar password rather than your real one.
How long should a password be?
At least 12 to 16 characters for most accounts. A passphrase of several random words is long and easier to remember.
Why is my password with symbols rated weak?
Symbols help less than people expect when the rest is a common word, a year or a keyboard pattern. Attackers try those patterns first, so the estimate drops.
Are the crack times exact?
No. They are rough orders of magnitude based on the stated guessing speeds. Real attacks vary with the hashing method and the attacker's tools.