Password Strength Checker

Password strength checker: enter a password and see instantly how much randomness it holds, which patterns weaken it, and how long an attacker would need in the worst case. Example: a random 12-character password using all four character types holds about 79 bits – roughly 1.7 million years at 10 billion guesses per second, while “Summer2024!” falls in under a second.

Source: NIST SP 800-63B, NIST SP 800-63B-4 – 3.1.1.2 Password Verifiers (length, blocklist). Updated: 27 September 2026.

How it is calculated

Your password is never sent anywhere. The check runs entirely in JavaScript on your device. The input field never appears in the address bar or browser history, and nothing is stored. Only a public list of common passwords is loaded once as a file and compared locally.

How to check a password

Type the password into the box – it never leaves your browser.
Read the strength, estimated entropy and any patterns found.
If it is weak, generate a new password and check again.

Example: in “Summer2024!” the checker spots the year 2024 as a pattern. It counts for only log₂(150) ≈ 7 bits – four truly random digits would add over 13 bits.

How the estimate works

1. Character pool × length: The character types present determine the pool (a–z 26, A–Z 26, 0–9 10, special characters 33, accented letters and others a flat 100). The naive entropy is length × log₂(pool) – for 12 characters using all four types, 12 × log₂(95) ≈ 78.8 bits.

2. Pattern penalties: People don’t pick random characters. Attackers therefore try leaked password lists first, words with substitutions (P@ssw0rd), sequences (abc, 123), keyboard rows (qwerty, asdf, azerty), repetitions, and years. This tool breaks your password down into such building blocks and, for each one, counts only the few bits an attacker needs to guess it – a simplified version of the zxcvbn method (Wheeler, USENIX Security 2016). The smaller of the two values is shown.

3. Crack time: 2^bits divided by the number of guesses per second – in other words, the time needed to try every possibility. Assumptions follow zxcvbn: an offline attack on a stolen password database with a fast hash (10 billion attempts/s, e.g. unsalted MD5 on GPUs) or with a slow hash (10,000 attempts/s, e.g. bcrypt). Online logins with lockouts are far slower to attack.

How long does it take to crack a password?

Password	Estimated entropy	Fast hash (10 billion/s)	Slow hash (10,000/s)
“Password1” (on the common-password list)	about 8 bits	instantly	instantly
“Summer2024!” (word + year + symbol)	21.1 bits	under 1 second	about 4 minutes
8 random characters, a–z and 0–9	41.4 bits	about 5 minutes	about 9 years
8 random characters, all four types	52.6 bits	about 8 days	about 21,000 years
12 random characters, all four types	78.8 bits	about 1.7 million years	far longer
16 random lowercase letters	75.2 bits	about 138,000 years	far longer
16 random characters, all four types	105.1 bits	about 140 trillion years	far longer

The time is 2^bits ÷ guesses per second, with a year of 365.25 days: 2^52.6 ≈ 6.6 × 10¹⁵ guesses take about 663,000 seconds, or 7.7 days, at 10 billion per second. Length beats complexity: 16 lowercase letters come close to 12 characters with all types. That is why NIST SP 800-63B asks for length and a blocklist check rather than forced character mixing.

Rating levels

Very weak under 40 bits (offline in under 2 minutes) or on the list of common passwords
Weak 40–59 bits (offline from minutes up to a good 3½ years)
Medium 60–79 bits
Strong 80–99 bits (offline millions of years)
Very strong 100 bits or more

The estimate is an upper bound: if an attacker knows personal details (names, birthdays, pets) or the password appears in a data breach, it can be cracked far faster. BSI recommendations (German Federal Office for Information Security): 8–12 characters with four character types, or 20–25 characters with two, and no keyboard patterns such as “asdfgh” or “1234abcd”. NIST SP 800-63B requires at least 15 characters if no second factor is used, and no forced character mixing – instead, checking against a list of known passwords.

Related: create a strong random password with the password generator, checksums with the hash generator and random IDs with the UUID generator.

Frequently asked questions

Is it safe to enter my password here?

The password is never transmitted and never stored – everything is calculated only in your browser. As a general rule, though: never enter a real password anywhere it isn’t needed. Test a password with the same pattern instead of your real one.

Does this tool check if my password has been hacked?

No. It only compares against a local list of the 10,000 most common passwords. Whether a password appears in a data breach can only be checked against a large leak database – which would require sending at least part of a hash, something this tool deliberately does not do.

Why is “Summer2024!” weak even though it has every character type?

Because it consists of a word, a year, and an appended special character – exactly the patterns attackers try first. Character types alone say little; what matters is how random the password actually is.

How many bits does a good password need?

For important accounts, 80 bits or more is a good target – for example 14 random characters from all character types, or 7 random words from a list of 7,776 words.

How long does it take to crack an 8-character password?

If all 8 characters are random and use all four character types, the estimate is 52.6 bits: about 8 days at 10 billion guesses per second. With only lowercase letters and digits it drops to 41.4 bits, about 5 minutes. A word with a number takes well under a second.

Is a 12-character password strong enough?

A random 12-character password with all four character types has about 79 bits, rated medium – just below the 80-bit mark for strong. One more random character brings it to about 85 bits; 16 characters reach about 105 bits.

How accurate is the crack time?

It’s a rough order of magnitude under the stated assumptions (10 billion or 10,000 attempts per second, trying every possibility). Real attacks depend on the service’s hashing method, the hardware used, and what the attacker already knows.

Sources and legal basis

As of: 27 September 2026 · Editorial policy