Password Strength Checker
Free password strength checker — estimates entropy before and after pattern penalties (dictionary words, keyboard walks, dates, repeats) and shows crack times for online, offline and GPU attacks. Analysed locally; no request is made.
Analysed locally — no request is made. Even so, prefer testing a variation rather than a password you currently rely on.
What an attacker gets for free
Time to crack
Runs entirely in your browser — nothing you enter is uploaded or stored.
Measuring a password properly
Most strength meters ask whether a password satisfies a policy: is it long enough, does it mix cases, does it contain a digit and a symbol. That is a checklist, and passwords built to satisfy checklists cluster — P@ssw0rd1, Summer2024!,Company123$ — which is precisely what cracking dictionaries are made of.
Two numbers, and the gap between them
The raw figure is what the length and observed alphabet imply if every character were chosen at random. The effective figure subtracts what each detected pattern saves an attacker, because a cracker does not enumerate the space uniformly — it tries dictionary words, dates, keyboard walks and repeats first. A generated password shows no gap. A memorable one usually shows a large one, and the gap is the honest measure of how much the memorability cost.
The scenarios are the point
A single "years to crack" number has to assume an attacker, and any assumption it makes will be wrong for most readers. The rows here span the realistic range: throttled online guessing at the slow end, a GPU cluster against a fast unsalted hash at the other. The same password can be unbreakable in one row and gone in seconds in another — which is a fact about the site storing it, not about the password.
Frequently asked questions
Is it safe to type a password into this page?
The analysis runs entirely in a WebAssembly module in your browser — there is no request, and this site has no endpoint that could receive one. That said, the honest advice is the same for every site making this claim: do not paste a password you are currently using anywhere. Test a variation, or test the kind of password you are considering.
Why is my password weaker here than on other checkers?
Most meters count character classes — did you use an uppercase letter, a digit, a symbol — which measures compliance with a policy rather than resistance to guessing. This one estimates how many guesses an attacker needs, and subtracts what patterns give away. P@ssw0rd1 satisfies every policy checkbox and is in every cracking dictionary.
What are the penalties?
Each detected pattern reduces the effective entropy by the amount it saves an attacker. A repeated character, a keyboard walk like qwerty, a sequence like 12345, a date, a dictionary word — crackers try these first, so they are not worth their raw length. The listed penalties add up to the gap between the raw and effective figures.
How much entropy is enough?
Against an offline attack on a properly hashed database, roughly 80 bits puts you beyond reach for the foreseeable future. Against a fast unsalted hash, you want more. Against a rate-limited login with lockout, far less will do. The number that matters is always relative to what the other side stored.