Password Strength Checker

The analysis runs entirely in your browser with JavaScript — the password is never transmitted, saved, or logged, and you can go offline after the page loads and it still works. That said, the safest habit is to test passwords structurally similar to yours rather than the exact one you use.

Entropy measures unpredictability. Each bit doubles the number of possible passwords, so 40 bits means about a trillion combinations and 60 bits about a quintillion. It is a cleaner measure of strength than “has a capital letter and a number”, because it accounts for both length and variety.

It is an approximation, not a guarantee. It assumes an offline attacker guessing about ten billion times per second against a fast hash, then divides the number of possible combinations by that rate. Real attacks vary enormously with the hashing used, so treat it as a relative guide, not a promise.

Length alone is not enough if the password is predictable. Common words, names, dates, keyboard runs like “qwerty”, and repeated characters are all guessed early, so the tool reduces their score even when they are long.

Length is the biggest factor, followed by unpredictability. Aim for at least 12–16 characters that do not form words, dates, or patterns. A random mix of character types, or a string of several unrelated words, both work well.

They can be, because their strength comes from length and word choice. Several genuinely random, unrelated words are both memorable and high-entropy. The weakness is picking predictable phrases like song lyrics or common sayings.

A little, but less than people expect. Tacking “!” onto the end of a weak password is a pattern attackers try first. Spreading variety through the whole password, and above all adding length, helps far more.

Because it is built from patterns: a capitalised dictionary word, sequential digits, and a trailing symbol. Attack tools generate exactly these combinations early, so the effective entropy is far lower than the character mix suggests.

Yes. Even a strong password becomes a liability if it is reused and one site is breached. A password manager lets you use a unique strong password everywhere without memorising them.

No. Nothing is saved. The value exists only in the page while you type it and is gone when you close or reload the tab.

This tool evaluates a password you already have; the generator creates a new cryptographically random one for you. If a password scores poorly here, generating a fresh one is usually the fastest fix.