How to use the password strength checker
- Type or paste a password into the box. Use a similar one rather than a password you rely on for an important account. Tick Show the password if you want to see what you typed.
- Choose an example guessing speed. Online means a service that limits repeated attempts. Offline means a stolen database attacked with fast hardware.
- Read the rating, the estimated bits of strength, the example time to find the password and the list of patterns that were detected.
- Follow the things to consider list, then use Copy result if you want to keep the rating. The copied text never contains the password.
Formula
pool = 26 (lowercase) + 26 (uppercase) + 10 (digits) + 33 (symbols) + 100 (other characters), for each type present
bits = sum of log2(pool) for plain characters + cost of each detected pattern
average time = 2^bits / 2 / guesses per second
A plain character costs log2 of the pool size. A detected pattern replaces the characters it covers with a cheaper cost, and the cheapest way to split the password wins.
Worked examples
abcdefgh looks random at first glance: eight lowercase letters would be 8 x log2(26) = 37.6 bits. But it is a sequence, which costs log2(26) + log2(8) + 1 = 8.70 bits, so it is rated Very easy to guess. password is one of the 50 passwords in the built-in list, which costs log2(50) = 5.64 bits.
Summer2024! uses all four character types, but it is the common word Summer (log2(50) + 1 for the capital = 6.64 bits), a year (log2(200) = 7.64 bits) and one symbol (log2(95) = 6.57 bits), a total of 20.86 bits, which takes about 16 minutes at 1,000 guesses per second. Tr0ub4dor&3 has no pattern in the small list, so it is counted as 11 random characters at log2(95) each, 72.27 bits, or about 9,012 years at 10 billion guesses per second. Real cracking tools know far more patterns than this page does, so that second rating is much more optimistic than reality.
What the rating means and does not mean
The rating is a teaching estimate made from a few simple rules. It checks length, the kinds of characters used, repeated characters, simple sequences, keyboard rows, years from 1900 to 2099 and a small built-in list of about 50 very common passwords with common look-alike swaps such as 0 for o. Real attackers use huge lists of leaked passwords and many more rules, so a good rating here is an upper limit on how strong a password could be.
No rating can say that a password is safe. A password that appeared in a data breach is unsafe however it looks, and one reused on several sites is only as safe as the weakest site. Phishing, malware and weak recovery questions bypass password strength altogether. A password manager, a different password for every account and a second sign-in step matter more than any score.
Privacy
The password is checked by code running in your browser. It is not sent to any server, not written to your device storage, not included in the share link and not part of the copied result. The field clears when you leave the page. Browsers and extensions can still read what you type, so for real passwords use a trusted device.
To make a new password, the password generator creates random ones, and the text encryption tool can protect a note with a passphrase.
Assumptions and limits
- The built-in list has 50 entries and is far smaller than real cracking lists, so common passwords outside it are not recognized.
- Guessing speeds of 1,000 and 10 billion per second are examples. Real speeds depend on how the password is stored and on the attacker.
- Passwords over 200 characters are refused to keep the page responsive.
- Dictionary words that are not in the small list, names, dates other than four-digit years and personal details are not detected.
Frequently asked questions
Does a high rating mean my password is safe?
No. The rating only reflects length, character types and a few patterns. A password can score well and still be unsafe if it was leaked, reused, guessed from personal details or stolen by malware.
Is my password sent anywhere when I type it?
No. The check runs in your browser, nothing is transmitted or stored, and the copied result leaves the password out. Still, avoid typing real passwords into any site you do not control.
Why is a long password with symbols rated Very easy to guess?
Because the tool found patterns that replace many characters with a cheap cost, such as a common word plus a year. Attackers try those combinations first, so adding symbols to a predictable base adds little.
Is a passphrase better than a short complex password?
Length helps most, and several unrelated words can be long and easy to remember. The words must be chosen at random rather than from a quote or a song, otherwise they can be guessed more easily.