Check password strength
Type a password and see its length, character classes, entropy bits, an offline crack-time estimate, and a strength verdict.
Drop your file here
or click to browse
Nothing has left this page since you opened the tool. Show network activity
The browser enforces this: the site’s security policy only lets the page talk to the code libraries’ servers and an anonymous usage counter (tool name, file type, size range). A request carrying your file to anywhere else would be blocked before it left.
Check it yourself: open your browser’s developer tools, go to the Network tab, and run the tool. Or turn off Wi-Fi once the tool has loaded; it keeps working.
How it works
Type a password and see its length, character classes, entropy bits, an offline crack-time estimate, and a strength verdict.
The tool scores the password on three dimensions: length, the number of character classes used (uppercase, lowercase, digit, symbol), and the calculated entropy (bits = length × log2(pool size)). A heuristic combines these into a verdict from Very weak to Excellent, with a color-coded strength meter. The offline crack-time estimate assumes 10 billion guesses per second (typical for a fast offline attack on a slow hash like bcrypt). Crack times above 1000 years show as centuries. This is a basic entropy scorer, not a dictionary or breach check. It can't tell you that a common substitution like P-at-ssw0rd123 is already in every cracker's wordlist (it is), only that it's longer than 8 characters and uses four classes. Real-world password security is also about not reusing passwords across sites; this tool only scores a single password's strength against guessing.
How to use it
- Type a password. Scoring is purely local — nothing is transmitted, logged, or stored.
- Read the verdict. Length, character classes, and entropy bits combine into a strength rating.
- Check the crack-time estimate. It assumes 10 billion offline guesses per second; aim for 100+ bits of entropy.
- Remember the limits. This is an entropy scorer, not a breach or dictionary check — common patterns still rate too high.
Frequently asked questions
- Is my password sent anywhere?
- No. The scoring is purely local heuristics. Nothing is transmitted, logged, or stored.
- Why is 'P@ssw0rd123' rated higher than it should be?
- This is an entropy scorer, not a dictionary check. It doesn't know which patterns are in cracker wordlists. For a real-world check, also assume any common substitution pattern is known.
- What's a good entropy target?
- 60 bits is fine for low-value accounts. 100+ bits is excellent. Random 20-character passwords with mixed classes hit ~130 bits.
- Does this check if my password has been breached?
- No. For breach checks, use a tool that queries Have I Been Pwned with a hashed prefix (the safe k-anonymity protocol).