Password Strength Checker

How this password strength checker works

Password strength is really a measure of how hard a password is to guess. The most useful way to express that is entropy, measured in bits. The more unpredictable a password is, the more guesses an attacker has to make on average before hitting it — and each additional bit of entropy doubles that effort.

This tool estimates entropy from two ingredients. First it works out the character pool size by checking which character classes you used: lowercase letters add 26, uppercase letters add 26, digits add 10, and common symbols add about 33. Then it multiplies the password length by the base-2 logarithm of that pool size: bits = length × log2(poolSize). A 12-character password using all four classes draws from a pool of 95, giving roughly 79 bits.

Reference note: this is a fast, transparent estimate based on character classes and length. It does not run a full dictionary or pattern analysis, so a password made of a common word (like "Password1!") can score higher here than it truly deserves. Always avoid real words, names and dates regardless of the rating. The crack-time figure assumes 10 billion guesses per second offline and is illustrative only.

Frequently asked questions

Is this password checker safe, and where does my password go?

It is safe to use. The checker runs entirely in your browser using local JavaScript. Your password is never sent over the network, never stored and never logged — it never leaves your device. You can confirm this by disconnecting from the internet; the tool keeps working.

What makes a password strong?

Strength comes from unpredictability, driven by length and variety. A longer password mixing lowercase, uppercase, digits and symbols has far more possible combinations, so it is much harder to guess. Avoid dictionary words, names, dates and common patterns, and never reuse a password across sites.

What is password entropy?

Entropy measures unpredictability in bits. It is estimated as length × log2(pool size). Each extra bit doubles the number of guesses an attacker must try. Roughly: under ~28 bits is very weak, 36–59 bits is fair, and 60+ bits is strong.

How long should a password be?

Aim for at least 12 characters, and 16 or more for important accounts. Length matters more than complexity: a long random passphrase can beat a short cryptic string. With a password manager you can use 20+ random characters everywhere.

Are passphrases better than complex passwords?

Often yes. A passphrase of four or five random, unrelated words is long, high in entropy and easier to recall than a short cryptic string. The key is that the words are chosen randomly — not a famous quote or common phrase.

Should I use a password manager?

Yes. A password manager generates long, unique, random passwords for every site and remembers them, so you only memorise one strong master password. This removes reuse — the biggest real-world risk — and makes strong passwords practical everywhere.