Password Strength Checker
How strong is your password, really? Score, entropy and crack time — with the patterns that give it away.
Type a password to see its score.
How long would it take to crack?
| Attack | Speed | Average time |
|---|---|---|
| Online, rate-limited | 100 guesses / hour | |
| Online, no rate limit | 10 guesses / second | |
| Offline, slow hash (bcrypt) | 10,000 / second | |
| Offline, fast hash (MD5) | 100 billion / second |
What is holding it back?
A high score means the password avoids the weaknesses checked here — it is not proof it cannot be stolen by phishing, a breach or reuse. Use a different strong password per account and turn on two-factor authentication.
How to use the Password Strength Checker
- Type a password to test — ideally a lookalike with the same length and pattern as a real one, not a password you actually use.
- Read the score, the entropy in bits, and how long each of four attacks would take to crack it.
- Work through the warnings list to fix the weaknesses, or generate a strong password instead.
Password Strength Checker FAQs
Is it safe to type my password into this checker?
The check runs entirely in your browser — the page makes no network request with what you type, and nothing is stored or logged. Even so, the safest habit is to test a lookalike: a password with the same length and pattern as the one you use, with a few characters changed. Never paste a password you use into any website, ours included.
What does the score actually measure?
The 0–100 score is transparent, not a black box: points for length (up to 40) and character variety (up to 30), plus a bonus for high entropy (up to 15), minus penalties for patterns a real attacker would try first — common passwords, dictionary words, keyboard walks, sequences, repeated characters and years. A password found in the common-password list scores 0 whatever its length.
What is entropy, and how many bits do I need?
Entropy counts the bits of unpredictability in a password, assuming random characters: entropy = length × log2(pool size), where the pool is the character classes you used. Under 28 bits is very weak, 36–59 is reasonable, 60–127 is strong and 128+ is very strong. A 12-character random password from all four classes has about 79 bits; a memorable phrase you invented is not random, so treat the figure as an upper bound.
How are the crack times calculated?
From the estimated number of guesses (2 raised to the entropy) divided by the attack speed: 100 guesses per hour for a rate-limited online attack, 10 per second for an unthrottled online attack, 10,000 per second for an offline attack on a slow hash such as bcrypt, and 100 billion per second for an offline attack on a fast hash such as MD5. Times are averages — an attacker finds the password about halfway through the keyspace.
My password scored Strong — does that mean it is uncrackable?
No. It means it avoids the specific weaknesses this tool checks. A password can still be stolen by phishing, a data breach, malware or reuse across sites. Use a different strong password for every important account, turn on two-factor authentication, and use a password manager instead of memorising them all.
Free Password Strength Checker — Score, Entropy & Crack Time
This free password strength checker scores any password from 0 to 100 with a transparent method — length, character variety and entropy, minus penalties for the patterns attackers try first — and shows how long four kinds of attack would take to crack it.
How to use it, step by step
- Type a password to test (a lookalike is safest — never a password you actually use).
- Read the score, the entropy in bits and the crack times for online and offline attacks.
- Fix the warnings listed, or generate a strong password with our generator.
Popular uses
- Check a new password before you start using it anywhere.
- Learn why a familiar-looking password is weaker than it feels.
- Compare candidate passphrases and pick the strongest one.
- Teach a team or family what actually makes a password hard to guess.