PopularHot
Password Generator
Password Generator computed locally with Web Crypto — your secrets never leave the page.
SecurityOpen Tool
Password Strength Checker
Test a password's strength and estimate its entropy in bits, with specific tips — all locally. Nothing you type is sent.
Loading Password Strength Checker…
Your browser is preparing the tool. It runs 100% locally.
Quick Answer
Type a password and the checker rates it from Very weak to Very strong and estimates its entropy in bits from its length and the character types it uses, then lists what would improve it. Everything runs in your browser — the password is never sent. One honest caveat: the entropy figure assumes a random password, so a real dictionary word scores higher here than it deserves.
What the Password Strength Checker Does
As you type, three things update live: a rating, an entropy estimate in bits, and a short checklist of what to fix — more length, mixed case, a number, a symbol. It is a quick coach for a single password, not a database of leaked ones.
It rewards the things that genuinely enlarge an attacker's search space: length first, then variety. Watch the bit count climb as you add characters and it makes the trade-offs concrete.
How It Works
Five checks each add a point: at least 8 characters, at least 14, both upper and lower case, a digit, and a symbol. The total from 0 to 5 maps onto the Very weak to Very strong scale.
Entropy is estimated separately as length times log2 of the character pool, where the pool counts 26 for lowercase, 26 for uppercase, 10 for digits and 32 for symbols — summed over only the classes your password actually uses.
What it checks & how
Nothing is fetched or sent. The rating and the entropy estimate are both computed in the page from the characters you type — there is no server call and no breach-list lookup.
- Step 1. Award a point if the password is at least 8 characters (and suggest more if not).
- Step 2. Award another point at 14 or more characters.
- Step 3. Award a point for having both uppercase and lowercase letters.
- Step 4. Award a point for containing a digit, and a point for a symbol.
- Step 5. Map the 0–5 total to a rating, and separately compute entropy = length × log2(pool), pool = 26/26/10/32 over the classes present.
Entropy estimate
bits = length × log2(pool)
pool = 26 (lower) + 26 (upper) + 10 (digits) + 32 (symbols), counting only the classes usedWorked examples
'password' (8 lowercase): 8 × log2(26) ≈ 38 bits — yet it is a top-of-the-list breached word, so really near zero16 random chars, all classes (pool 94): 16 × log2(94) ≈ 105 bitsThe formula assumes randomness. It cannot see that 'password' or 'Pa$$w0rd' is a known pattern, so read the bits as a ceiling, not a verdict.
Privacy
Your password is evaluated entirely in your browser — it is never transmitted, and the checker makes no network request.
Nothing is stored or logged: clear the field or close the tab and it is gone.
If you would rather not type a live account password anywhere, test a stand-in of the same length and character mix — the rating and bits will match.
Technical Details
| Checks | Length ≥8, length ≥14, upper+lower, a digit, a symbol |
|---|---|
| Rating | Very weak to Very strong (0–5) |
| Entropy | length × log2(pool), pool 26/26/10/32 |
| Breach check | Not performed |
| Pattern / dictionary detection | None |
| Input | Typed password, shown in plain text |
| Where it runs | In your browser — never sent |
Standards & references
- NIST SP 800-63B — recommends screening passwords against lists of breached and common values and favouring length over forced complexity. This tool does the length-and-variety part but does not check breach lists.
- Entropy (bits) — length × log2(pool) — the standard unpredictability measure, valid only under the assumption that the password is random.
- Breach screening — comparing a candidate against known-leaked passwords (for example via Have I Been Pwned) is the single most useful real-world test — and one this tool does not perform.
Accuracy & Limitations
The core limitation: it measures theoretical entropy, not real guessability. It can't tell that 'Summer2024!' follows a predictable pattern, so it will over-rate passwords built from words, dates and keyboard runs. A high score is necessary, not sufficient.
It does not check your password against breach corpora — the most valuable test in NIST's guidance. A password can read 'Strong' here and still sit on a public leak list. Pair this with a breach lookup for real assurance.
The field shows your password in plain text so you can see what you typed. That's fine on your own screen; be mindful in public or on a shared display.
Ratings are threshold-based, so adding a single character can bump the label a whole step. The entropy number moves more smoothly and is the better guide.
Real-World Use Cases
Sanity-checking a new password
See roughly how strong a password is before you commit to using it somewhere.
Teaching why length wins
Add characters and watch the bits jump — a fast way to show what actually moves the needle.
Comparing two candidates
Type each and compare the entropy to pick the stronger option.
Deciding whether to lengthen
Check whether a password clears a comfortable bit threshold before saving it.
When to use it — and when not to
Good for
- A quick, private strength check
- Understanding entropy in bits
- Coaching better password habits
- Comparing two passwords side by side
Not the best choice for
- Proving a password isn't breached
- Auditing real-world guessability of patterned passwords
- Creating a strong password from scratch
To generate a strong password, use the password generator. To catch breached or pattern-based passwords, use a checker built on a breach list or on zxcvbn-style pattern analysis. This tool is a fast first look, not the final word.
Frequently Asked Questions
How is the strength rated?
Five checks each add a point — at least 8 characters, at least 14, both letter cases, a digit and a symbol — and the 0-to-5 total maps to Very weak through Very strong.
What does the entropy number mean?
It estimates unpredictability in bits as length times log2 of the character pool. More length and more character types both raise it; each bit doubles the guesses needed.
Why does a 'strong' password still feel guessable?
Because the entropy formula assumes the password is random. A patterned password like 'Summer2024!' has high nominal entropy but is easy for a cracker that knows common patterns, so the bits overstate its real strength.
Does it check whether my password was breached?
No — and that's an important gap. Breach screening (comparing against known-leaked passwords) is the most useful real test. A password can score well here and still be on a leak list, so check it separately.
Is my password sent anywhere?
No. Both the rating and the entropy estimate are computed in your browser. Nothing you type is transmitted or stored.
Why is the password shown in plain text?
So you can confirm exactly what you typed, including spaces and symbols. It's local to your screen — just be aware of who can see it in public.
How many bits is 'enough'?
As a rough guide, under about 50 bits is weak, 60–80 is reasonable for most accounts, and 100-plus is strong. Context matters: a high-value account deserves more, and a breached password is weak at any bit count.
Does it detect dictionary words or keyboard patterns?
No. It counts character classes and length, not structure, so it won't flag 'qwerty' or 'letmein'. Tools based on zxcvbn do that kind of pattern analysis.
Why did adding one character jump the rating?
The rating uses thresholds (such as 8 and 14 characters), so crossing one flips a whole point. The entropy figure changes gradually and is the smoother measure.
What's the difference between this and the password generator?
This one analyses a password you already have; the generator creates a new random one for you. Use the generator to make a password, this to grade one.
Should I type my real account password into any website?
Be cautious in general. This tool runs locally and sends nothing, but the safest habit is to test a representative password of the same length and make-up rather than your live one.
What symbol pool does the entropy use?
It assumes 32 for the symbol class, plus 26 each for upper and lower case and 10 for digits, summed over whichever classes appear in your password.
References
It estimates theoretical entropy (assuming randomness) and never checks a breach list — so a high score here is necessary, not sufficient — and nothing you type is sent.
Related Tools
Popular
Random Number Generator
Random Number Generator computed locally with Web Crypto — your secrets never leave the page.
SecurityOpen Tool
Trending
SHA-256 Hash Generator
SHA-256 Hash Generator computed locally with Web Crypto — your secrets never leave the page.
SecurityOpen Tool
Trending
Passphrase Generator
Passphrase Generator computed locally with Web Crypto — your secrets never leave the page.
SecurityOpen Tool
MD5 Hash Generator
Use MD5 Hash Generator for stronger security hygiene — private, instant and free.
SecurityOpen Tool
SHA-1 Hash Generator
SHA-1 Hash Generator computed locally with Web Crypto — your secrets never leave the page.
SecurityOpen Tool
Ready to try the Password Strength Checker?
It is free, private and runs entirely in your browser — no sign-up, no uploads, no limits.