Password Strength Checker

This checker never sends the password anywhere — the analysis runs in the page. That matters more than the algorithm: a strength checker that transmits the password is worse than none at all.

The score is entropy-based with penalties for the patterns attackers actually try first: repeated characters, keyboard sequences, digits only, years, and common password words. It is not a full dictionary attack simulation, and the page does not claim to be.

How to use it

1. Type or paste a password into the field.
2. Read the bit count first, then the estimated crack time.
3. Fix the listed notes before worrying about the colour of the bar.

How the estimate is calculated

The base figure is the size of the character set actually used, multiplied by length, in bits. A password of only lowercase letters has a 26-character set; adding digits raises it to 36, and so on. The result is then reduced if a weak pattern is found — a 12-character password with '1234' in it is not worth the full 12-character figure.

The crack-time estimate assumes 10^11 guesses per second, roughly a multi-GPU offline attack against a fast hash. Against a slow hash such as bcrypt it is pessimistic by several orders of magnitude; against a site storing plaintext it is optimistic.

Reviewed 2026-10-21. This tool runs entirely in your browser — no server, no account, and nothing you generate is stored.