🛡️ Password Strength Checker
An honest strength check: entropy math plus the pattern warnings that matter — because "Summer2026!" passes complexity rules and falls in seconds.
Evaluated entirely in your browser — nothing typed here is transmitted, stored or logged.
How the password strength checker works
The checker estimates entropy from length and detected character sets (length × log₂ of alphabet size), then looks for the patterns that make real passwords weaker than the formula suggests: known most-cracked passwords, sequential runs (abc, 123, qwe), repeated characters, embedded years, and the classic Word+digits+! shape. Cracking tools encode exactly these patterns as mangling rules, so their presence caps the realistic strength regardless of raw length.
A checker can prove weakness, not safety — passing here doesn't certify a password, it just fails to find the obvious problems. The reliable route is skipping human invention entirely: a generated random password has exactly the entropy the math says. This page exists mostly to show you why your current ones need replacing.
Frequently asked questions
Is it safe to type my real password here?
The check runs entirely in your browser — nothing is transmitted, stored or logged, verifiable by going offline. That said, the healthy habit is testing a password of the same shape rather than the exact one you use, and never typing real passwords into tools you don't trust.
Why does my "complex" password score badly?
Because complexity rules measure the wrong thing. Capital-first, digits-and-exclamation-last is the single most common password shape, and cracking software tries word+suffix mangles early. Patterns cost more strength than symbols add.
What score should I aim for?
For accounts behind rate-limited logins, roughly 60+ bits with no warnings. For anything crackable offline — master passwords, encrypted archives — 90+ bits, which in practice means a generated random password or a 5+ word random passphrase.
Can any checker know my password's true strength?
No — true strength depends on how the password was chosen, which no checker can see. A checker detects weakness signals; absence of warnings is not proof of strength. Random generation is the only password whose entropy you can actually know.
Should I change passwords regularly?
Not on a schedule — NIST dropped that advice because forced rotation produces Password1 → Password2. Change a password when it's weak, reused, or exposed in a breach.