Free tool

Password Strength Checker

Estimate the entropy and crack-time of any password — entirely in your browser.

How it works

Type a password to see how a modern attacker would view it. The check runs locally in your browser — nothing is sent over the network. We estimate entropy from length and character classes, then apply penalties for common passwords, keyboard runs, repeats and date patterns.

Methodology

Crack-time assumes an offline attack against a weakly-hashed credential database at roughly 10^11 guesses per second on commodity GPUs. Real systems with strong hashing (bcrypt, scrypt, argon2) and online rate limits are far slower to attack — but plan for the worst case.

Frequently asked questions

Is my password sent anywhere?

No. The check is JavaScript that runs locally. We don't have a server you could leak to.

Why does my favorite password score badly?

Common passwords are tried first. Even if it 'feels' clever, attackers have very large lists from past breaches. Length and randomness beat cleverness.

How long should a password be?

For accounts you care about: 14+ random characters in a password manager, or a 6+ word passphrase. For your master password: longer.

Other free tools