Password Strength Checker

Enter a password and see instantly how much randomness it holds, which patterns weaken it, and how long an attacker would need in the worst case. The check runs entirely in your browser.

How it is calculated

Your password is never sent anywhere. The check runs entirely in JavaScript on your device. The input field never appears in the address bar or browser history, and nothing is stored. Only a public list of common passwords is loaded once as a file and compared locally.

How the estimate works

1. Character pool × length: The character types present determine the pool (a–z 26, A–Z 26, 0–9 10, special characters 33, accented letters and others a flat 100). The naive entropy is length × log₂(pool) – for 12 characters using all four types, 12 × log₂(95) ≈ 78.8 bits.

2. Pattern penalties: People don’t pick random characters. Attackers therefore try leaked password lists first, words with substitutions (P@ssw0rd), sequences (abc, 123), keyboard rows (qwerty, asdf, azerty), repetitions, and years. This tool breaks your password down into such building blocks and, for each one, counts only the few bits an attacker needs to guess it – a simplified version of the zxcvbn method (Wheeler, USENIX Security 2016). The smaller of the two values is shown.

3. Crack time: 2^bits divided by the number of guesses per second – in other words, the time needed to try every possibility. Assumptions follow zxcvbn: an offline attack on a stolen password database with a fast hash (10 billion attempts/s, e.g. unsalted MD5 on GPUs) or with a slow hash (10,000 attempts/s, e.g. bcrypt). Online logins with lockouts are far slower to attack.

Rating levels

Very weak under 40 bits (offline in under 2 minutes) or on the list of common passwords
Weak 40–59 bits (offline from minutes up to a good 3½ years)
Medium 60–79 bits
Strong 80–99 bits (offline millions of years)
Very strong 100 bits or more

The estimate is an upper bound: if an attacker knows personal details (names, birthdays, pets) or the password appears in a data breach, it can be cracked far faster. BSI recommendations (German Federal Office for Information Security): 8–12 characters with four character types, or 20–25 characters with two, and no keyboard patterns such as “asdfgh” or “1234abcd”. NIST SP 800-63B requires at least 15 characters if no second factor is used, and no forced character mixing – instead, checking against a list of known passwords.

Frequently asked questions

Is it safe to enter my password here?

The password is never transmitted and never stored – everything is calculated only in your browser. As a general rule, though: never enter a real password anywhere it isn’t needed. Test a password with the same pattern instead of your real one.

Does this tool check if my password has been hacked?

No. It only compares against a local list of the 10,000 most common passwords. Whether a password appears in a data breach can only be checked against a large leak database – which would require sending at least part of a hash, something this tool deliberately does not do.

Why is “Summer2024!” weak even though it has every character type?

Because it consists of a word, a year, and an appended special character – exactly the patterns attackers try first. Character types alone say little; what matters is how random the password actually is.

How many bits does a good password need?

For important accounts, 80 bits or more is a good target – for example 14 random characters from all character types, or 7 random words from a list of 7,776 words.

How accurate is the crack time?

It’s a rough order of magnitude under the stated assumptions (10 billion or 10,000 attempts per second, trying every possibility). Real attacks depend on the service’s hashing method, the hardware used, and what the attacker already knows.

Sources and legal basis

As of: 27 September 2026