This password strength checker estimates how long it would actually take to crack a password, based on length and character variety rather than a simple pass or fail. Most strength meters show a vague label like “strong” without explaining why. This one estimates an actual crack time using a conservative offline-attack assumption, so the number means something concrete. Type anything into the box below and watch it update as you type. Nothing you enter is sent anywhere, the entire calculation happens in your own browser.
What This Password Strength Checker Measures
This tool calculates entropy, a measure of how unpredictable a password is, based on its length and which character types it uses. NIST’s current SP 800-63B-4 guidelines emphasize length over complexity, and the estimate below reflects that: a long password made only of lowercase letters can score better than a short one stuffed with symbols.
Strength: —
Estimated time to crack: —
🔒 This runs entirely in your browser. Nothing you type here is sent to our server or stored anywhere.
4 Signs Your Password Is Weak
📏 It’s Short
Length matters more than almost anything else. NIST now recommends at least 15 characters for anything protected by a password alone. Every extra character multiplies the number of guesses an attacker needs, while adding a symbol only multiplies it by a small, predictable amount.
📖 It’s a Real Word or Name
Dictionary words, names, and common phrases get tried first in any real attack, no matter how you capitalize them or swap a letter for a number. “P@ssw0rd” is not meaningfully safer than “password” to an attacker’s cracking tool.
🔁 It Follows a Predictable Pattern
Capital letter first, numbers at the end, one symbol before the numbers. This structure is so common that cracking tools check for it automatically. Predictable patterns give away far more than most people realize, even when every character type is technically present.
♻️ It’s Reused Somewhere Else
A strong password that’s reused on another site is only as safe as the weakest site it’s used on. If that site gets breached, this one is compromised too, regardless of how the number above looks. See our guide on dangerous password practices for more on this specific risk.
✅ A note on privacy: This page runs entirely as JavaScript in your browser. Nothing typed into the box above is transmitted to our server, logged, or stored anywhere. You can disconnect from the internet after the page loads and the tool will keep working, which is a reasonable way to verify that for yourself.
A high score here doesn’t guarantee a password is safe if it’s reused, guessable from personal details, or stored somewhere insecure. Treat this as one signal among several, not a final verdict.
If any of this sounded familiar, our login security checklist covers the bigger picture beyond just password strength, including sessions, multi-factor authentication, and password resets.