Overview
Most people judge a password by how it looks: a tangle of symbols feels strong, a plain word feels weak. Attackers do not judge by looks at all — they count. This checker counts the way they do, turning your password into two honest numbers: its entropy in bits, and a realistic estimate of how long it would survive a sustained guessing attack. If the result surprises you, that surprise is the point.
Everything runs locally in your browser. Passwords are the most sensitive strings most people own, so this page was built to never transmit anything: type freely, test candidates, and close the tab knowing no copy of what you typed exists anywhere but your screen.
What does “strength” actually mean?
A strong password is simply one with a search space too large to exhaust. That space is measured in bits of entropy: each bit doubles the number of guesses an attacker needs. A 40-bit password needs about a trillion guesses on average; an 80-bit password needs more guesses than there are stars in the observable universe. The checker derives your score from the length of the password and the size of the character pool it draws from.
Entropy alone is not the whole story, which is why the checker also hunts for patterns. A twelve-character password of the form “Password123!” has decent entropy on paper, yet guessing software tries exactly that shape early. Common passwords, keyboard walks, repeated characters and short lengths each earn you a plain-spoken warning, because a password is only as strong as its weakest habit.
Features
- Live entropy score computed from your password's actual character pool, updating with every keystroke.
- Crack-time estimate translated into plain language — from “instantly” to “millions of years” — at a realistic attack speed.
- Common-password detection against a list of the internet's most-abused passwords, which attackers always try first.
- Pattern warnings for keyboard sequences, alphabet runs, repeated characters and short lengths.
- Pool breakdown showing which character families you are using and which you are missing.
- Private by design: no network requests, no storage, no analytics on what you type.
Benefits
- Honest numbers, not vibes. You learn whether a password is actually strong or merely looks strong.
- Fix the weakest link first. The warnings tell you exactly what to change instead of guessing.
- Safe to experiment. Try ten candidates in a minute; nothing is recorded anywhere.
- Works offline. Once loaded, the page needs no connection at all.
Who can use it
Anyone choosing a password that matters: a new master password, a Wi-Fi key, an encryption passphrase, or the login to an account that guards money or email. It is also useful for the morbidly curious — paste in an old retired password (one you no longer use anywhere) and see how it scores. Developers and IT staff can use it to demonstrate to colleagues why “Company2024!” was never the fortress it looked like.
How to use
- Type or paste the password into the box at the top of the tool.
- Read the grade and the entropy score as they update live.
- Check the crack-time estimate to feel what the number means in practice.
- Work through the warnings one by one — each names a concrete weakness.
- Adjust the password (usually: make it longer) until the warnings clear and the grade reads Strong or better.
Frequently asked questions
Is it safe to type my real password here?
Yes, because nothing leaves your device. The page contains no network code that could transmit what you type, and your browser's developer tools can confirm that: open the network tab, type away, and you will see zero requests. As an extra precaution, never test a password you currently use on an important account — test candidates and retired passwords instead.
What crack speed does the estimate assume?
Ten billion guesses per second, which is roughly what a single high-end graphics card achieves against fast hashes. Slow, well-designed password hashing (the kind good sites use) cuts that speed enormously, while a leaked database of fast hashes lets attackers go quicker. The estimate is deliberately conservative: assume the attacker is fast.
My password got “Fair” — is that enough?
For a throwaway forum account, probably. For email, banking, or anything that can reset your other accounts, aim for Strong or Very strong. The cheapest upgrade is almost always length: four extra characters beat almost any clever substitution.
Why was my long password flagged?
Because it matched a known pattern — usually a common password with minor tweaks, like “Password123!” or a keyboard walk. Attackers keep dictionaries of exactly these shapes, so the checker warns you even when the raw entropy looks fine.
Does a high score mean the password is unbreakable?
No score can promise that. Strength only covers guessing; it says nothing about phishing, malware on your device, or a site storing passwords carelessly. A strong, unique password plus two-factor authentication is the combination that actually holds up.
Conclusion
Strength is arithmetic, not aesthetics. Run your candidates through the checker, fix what it flags — usually by adding length — and stop trusting passwords that merely look complicated. The goal is a password whose numbers, not whose appearance, do the defending.