Password Strength Checker — How Fast Would Yours Fall?
An honest strength estimate with crack times — and nothing you type leaves your browser.
🔒 Runs in your browser — files never uploaded ⚡ No signup 💯 Free
Time to crack
| Attack scenario | Guesses / second | Time |
|---|
Type a password and get an honest assessment: an entropy estimate, the specific weaknesses found — common-password lists, keyboard runs, the year on the end — and how long it would survive four realistic attack scenarios, from a rate-limited login form to an offline GPU rig.
Everything runs in your browser; this page makes no network request when you type. Even so, the smart habit is testing a password shaped like yours rather than the real one.
How to use Password Strength Checker
- Type a password — or a lookalike with the same length and pattern.
- Read the findings. They name the specific patterns weakening it, not just a score.
- Check the crack-time table. The offline-GPU row is the one that matters if a site you use gets breached.
- Fix the pattern, not the symbol. Length and randomness beat clever substitutions every time.
Why strength meters usually flatter
A naive meter multiplies length by character-set size, which scores Password1! as strong — ten characters over a 90-symbol pool. But crackers don't brute-force blindly: they run breach lists, then dictionary words with the usual mutations (capital first, digits and a ! last, a→@ swaps), then keyboard runs and years. This checker penalises exactly those patterns, so its numbers are closer to what an actual attack achieves.
What actually makes a password strong
Length and randomness — in that order. Every extra random character multiplies the search space; a 16-character random string is out of reach for any current hardware regardless of symbol mix. Human "complexity" (Summer2024!) adds far less than it looks, because it's complexity from a small menu every attacker knows.
The two honest strategies: a password manager generating long random strings (see our generator), or for the few you must memorise, a passphrase of 4–5 genuinely random words — not a lyric, not a quote.
Reading the crack-time table
The scenarios span the realistic range: an online attack against a rate-limited login is millions of times slower than an offline attack against a stolen database of fast hashes. That last row is why breached sites force resets — and why reusing a password across sites turns one breach into many. The times shown are averages (half the keyspace) — a lucky guess can land sooner.
Frequently asked questions
Is it safe to type my real password here?
The page makes no network request when you type — you can verify that in your browser's dev tools — so nothing leaves your machine. Still, the habit that protects you is never typing a real password anywhere but its own login box: test one shaped like yours (same length, same kind of pattern) instead.
Why does adding ! and 1 barely help?
Because attackers know everyone does exactly that. Cracking tools apply "rules" — capitalise the first letter, append digits and punctuation, swap a→@ — to every dictionary word. Your mutation is in the rulebook, so it adds a handful of guesses, not a wall. Length and randomness are what add walls.
What do the bits of entropy mean?
Each bit doubles the guesses an attacker needs. 40 bits ≈ a trillion guesses — hours for a GPU rig against fast hashes. 60 bits is out of casual reach; 80+ is out of everyone's. The estimate here is after pattern penalties, which is why "Password1!" scores far below its length's theoretical maximum.
Is a passphrase of words actually strong?
If the words are random, yes: four words from a large list ≈ 50+ bits, and it's memorable. If they're a lyric, a quote or a keyboard-adjacent phrase, no — those are in wordlists. Roll dice or use a generator; don't compose.
What should I actually do about weak passwords?
Use a password manager and let it generate 16+ random characters per site — unique everywhere, so one breach stays one breach. Memorise only the manager's own passphrase, and turn on 2FA where it's offered. That combination beats any amount of clever password design.