Password Strength Checker

What this checker does, and what it does not

You type a password and the page counts its length and which character classes it uses (lowercase, uppercase, digits, anything else). From those two facts it computes an entropy figure in bits, turns that into a brute-force time estimate, and scans for a few obvious patterns: well-known passwords, simple letter-to-symbol swaps, long repeats and runs like 1234. It is useful for getting a rough sense of weight class before you commit to a new password, or for judging whether a site's password policy is meaningful. It is a heuristic. A formula that sees only length and character classes cannot know whether a password is random or whether it has appeared in a breach, so a good score is never a promise that the password is safe.

How the entropy is calculated

If an attacker knew nothing and tried every combination, the number of candidates would be N^L, where N is the size of the character set and L the length. Entropy is the base-2 logarithm of that, H = L x log2(N) bits. This tool sets N by adding 26 if any lowercase letter is present, 26 for any uppercase letter, 10 for any digit, and 32 if there is any other character at all (punctuation, accented letters, emoji and so on). The time shown is 2^H divided by 10^10 seconds, which is the time to run through every combination; on average the password is found after about half of that.

Every extra bit doubles the number of candidates, so adding one character helps in proportion to the character set: about 4.70 bits for a lowercase-only password and 6.55 bits when all 94 printable ASCII characters are in play.

Character set by length (calculated at build time)

Notice that 12 digits (about 39.9 bits) land close to 8 lowercase letters (about 37.6 bits), and that 16 lowercase letters (about 75.2 bits) beat 8 characters drawn from the full set (about 52.4 bits) by a wide margin. These times describe only a password whose characters were chosen at random.

Sample inputs and how to read the results

The rows below were produced by this tool's own formula and re-checked with a short Node script. They are deliberately well-known weak examples; do not use them.

• 12345678 is eight digits, 26.6 bits, and falls in under a second. In practice it sits at the top of every leaked-password list, so it fails before any math is needed.
• P@ssw0rd! scores 59.0 bits on paper, which falls in the Weak band, but it is the textbook case of password with letters swapped for symbols. Dictionary attacks break it far faster than the figure suggests, and this checker flags such substitutions.
• aaaaaaaaaaaaaaaa (sixteen a's) gets 75.2 bits from the formula, yet a single repeated letter holds almost no information. This is the standard example of the formula losing meaning once the "chosen at random" assumption breaks.
• correcthorsebatterystaple has 25 lowercase letters and scores 117.5 bits. That is only meaningful if four words were truly drawn at random, and this exact phrase is famous enough to be in attack dictionaries already. A passphrase works when the words are generated randomly, such as by the Passphrase Generator.
• Tr0ub4dor&3 mixes four character classes and scores 72.1 bits, but it is a lightly disguised dictionary word, so a rule-based attack makes it much weaker than the number implies.

The strength labels

The bands used here are: under 40 bits is Very weak, 40 to 60 is Weak, 60 to 80 is Moderate, 80 to 100 is Strong, and 100 or more is Very strong. These cut-offs are this site's own rule of thumb, not an industry standard. If a common password, a long repeat or a sequence is detected, the label is lowered regardless of the calculated number: a known-weak password is shown as Very weak, and any other flag caps the label at Weak.

What current guidance says

NIST's digital identity guidelines (SP 800-63B, revision 4 published in 2025) keep the emphasis on length and blocklists. According to section 3.1.1.2 ("Password Verifiers") of the text at pages.nist.gov/800-63-4, a verifier requires at least 15 characters when the password is the only authentication factor and at least 8 when it is only one part of multi-factor authentication; it should permit passwords of at least 64 characters; it must not impose composition rules such as mandatory character mixes; it must compare candidates against a list of commonly used or compromised passwords; and it must not force periodic changes without evidence of compromise. Unicode characters are counted by code point. Details and scope are in the source document, and your own organization's policy may be stricter.

Common mistakes and myths

• "A symbol at the end makes it safe." Appending "!" or "1" is the first transformation attack tools apply.
• Reusing one password across sites. When one site leaks it, attackers replay it elsewhere (credential stuffing). No entropy figure helps a reused password.
• Birthdays, phone numbers, names and keyboard walks. qwerty, 1q2w3e4r and asdf1234 are all in the dictionaries.
• "Hundreds of years, so I'm fine." The estimate depends on how the service stores the hash and how many guesses per second the attacker manages. 10 billion per second is one assumption about a fast hash attacked offline, nothing more.

Limits of this tool

• It does not look passwords up in breach databases. It checks only a short built-in list of very common passwords, so "no warning" does not mean "safe".
• Length is counted in code points, so one emoji counts as one character. Services count differently (UTF-16 units, bytes), so the same string may be accepted by one site and rejected by another.
• All non-ASCII letters and symbols are lumped into one class of 32, which is a simplification.
• It does not model multi-factor authentication, login rate limits, or the slow hashes (bcrypt, Argon2) that real services use.

Privacy and handling

The calculation runs in the page script each time you type. The script contains no fetch call, no form submission and no storage write; the value stays in the input field until you leave or reload the page. The field is masked by default and only shown when you tick "Show what I type". The tool cannot protect against browser extensions, keyloggers on shared computers or people looking over your shoulder. On any web page that loads third-party scripts such as ads, the safest habit is never to paste a real password: use a similar string with the same length and character mix instead.

How to use the result

A password at or above 80 bits with no pattern warnings, that you do not reuse anywhere else, is a solid choice for ordinary accounts. For email, banking and the master password of a password manager, use 16 or more random characters or a passphrase of several random words, and switch on multi-factor authentication. Anything too hard to remember belongs in a password manager. If you need a random candidate, use the Password Generator.

Related tools

• Password Generator: create a random password
• Passphrase Generator: random words with exact entropy
• Hash Generator: see how a string becomes a hash
• Regex Tester: experiment with patterns for password policies

Frequently Asked Questions