Free Tool
Password Strength Checker
Type a password to see how it measures up: length, character variety, common patterns and whether it appears on a list of the most-used passwords. The result is an estimate, not a verdict — but it shows clearly why length beats cleverness, and why a long passphrase beats a short string of symbols.
Your password never leaves this page. This checker runs entirely in your browser — nothing you type is sent anywhere, stored or logged. Even so, the safest habit is to test a password built like yours, rather than your real one. The page works offline once loaded.
What this tool does
A password's strength is mostly a question of how many guesses an attacker would need. Each extra character multiplies the possibilities, and variety — mixing upper and lower case, numbers and symbols — multiplies them further. But attackers do not guess at random: they try the passwords people actually use, common words, names, dates and simple patterns first. So a checker has to look at more than length: it has to catch the shortcuts attackers already know.
This checker scores your password on four things: length, character variety, patterns (repeated characters, keyboard walks like qwerty, dates, simple sequences) and whether it appears in a small built-in list of the most commonly used passwords. It then estimates how long an offline guessing attack might take at ten billion guesses per second — a fast-attacker figure used for illustration — and explains the result in plain English, including what to change first if the password is weak.
The checker is part of a small bundle on this site: the entropy calculator explains the maths behind the score, and the password generator builds a strong password or passphrase for you. The guide linked below covers the current NIST guidance, including why 15 characters is the modern baseline for a password used on its own.
Try it
Type a password to test it. Use a test password built like yours — same length and style — rather than your real one.
Waiting. Type a password and press Check strength. The result is an estimate, not a guarantee.
How it works
The checker works in three passes. First it measures length and counts which character groups appear: lower-case letters, upper-case letters, digits and symbols. A longer password with more groups has a larger search space, which is the raw material of strength. Second, it looks for the patterns attackers try first: the same character repeated, keyboard sequences, common words and sequences such as 123456, and dates. These patterns slash the effective strength of a password no matter how long it looks. Third, it checks the password against a small built-in list of the most commonly used passwords — if it is on that list, it fails outright, because attackers try those first.
Then it estimates a crack time. It multiplies the size of the character set by the length to get the total number of possible passwords, and divides by ten billion guesses per second — roughly what a well-equipped attacker can try offline against a stolen password file. The number it shows is a rough guide, not a measurement: real attacks depend on the hashing algorithm used to store the password, the attacker's hardware and whether your password was already exposed in a breach. The guide on password entropy explains the same maths in more depth, including why the commonly quoted targets disagree.
Everything happens in your browser. The page makes no network requests while you use it — you can verify that in your browser's developer tools, on the Network tab. The password is never stored, never logged and never sent anywhere, and it disappears when you close the page.
Limitations
A strength score is an estimate, not a guarantee. This checker cannot tell you whether your password was already exposed in a data breach, whether you reused it on another site, or whether the service holding it stores it securely. A password that scores well here is still unsafe if it was leaked before or reused across accounts. Strength is one habit among several: uniqueness and two-factor authentication matter at least as much.
- The common-password list built into this page is small — it catches the worst offenders, not every breached password ever seen.
- Crack-time estimates assume an offline attack at ten billion guesses per second; online logins are far slower, and a breached password needs zero guesses.
- The checker judges the text you typed, not the account: a strong password on a service that stores passwords badly is still at risk.
Examples
Example 1 — password123. Eleven characters, but it scores as very weak. It is on the common-password list, it uses a single dictionary word plus a predictable number sequence, and an attacker would try it in the first seconds of any attack. Length did not save it, because the pattern was already known.
Example 2 — Tr0ub4dor&3. A short password with mixed character types and a symbol, the classic example of complexity over length. It scores as weak to moderate: eleven characters is simply not enough against a fast offline attack, however mixed the characters are. This is why current guidance prefers length over forced symbols.
Example 3 — correct horse battery staple. Four random ordinary words, 28 characters including spaces. It scores as strong: the length makes the search space enormous, and the words are random rather than a phrase someone would guess. A passphrase like this is both easier to remember and harder to crack than a short string of symbols — and it is exactly what modern guidance recommends.
Frequently asked questions
Is it safe to type my real password into this checker?
This checker runs entirely in your browser and sends nothing anywhere — you can check that in your browser's Network tab. Even so, the safest habit is to test a password built like yours rather than your real one, and to never type a real password into any website you do not fully trust.
What is the minimum length for a good password?
Current NIST guidance (SP 800-63B Revision 4, July 2025) requires at least 15 characters for a password used on its own. Longer is better: every extra character multiplies the number of possible passwords.
Does adding symbols make a password strong?
It helps, but length matters more. A short password with symbols is still weak against a fast offline attack, while a long passphrase of ordinary words is strong. Symbols are a bonus, not a substitute for length.
Why did my password score badly even though it is long?
Usually because of a pattern: a common word, a repeated character, a keyboard sequence or a date. Attackers try those first, so a long password built from predictable pieces is far weaker than its length suggests.
Is a strong password enough to keep my accounts safe?
No — it is one of three habits. Give every account its own unique password, and turn on two-factor authentication wherever it is offered. A strong password that was leaked in a breach or reused elsewhere is still unsafe.