Is my password sent anywhere or stored?

No. All analysis happens locally in your browser as you type, and the tool deliberately never persists the password or encodes it into the page URL. You can confirm this by checking your network tab — there are no requests when you type.

How is the 0-4 strength score calculated?

The score is derived from estimated entropy in bits after pattern penalties. Roughly: under 28 bits is 0 (Very weak), under 40 is 1 (Weak), under 60 is 2 (Fair), under 80 is 3 (Strong), and 80 or more is 4 (Very strong). Any password found in the bundled common-password list is forced to 0 regardless of its raw entropy.

What do the five crack-time scenarios mean?

Throttled online assumes a rate-limited login at 100 guesses per hour. Unthrottled online assumes 10 guesses per second. Offline slow hash assumes 10,000 guesses per second against bcrypt or argon2. Offline fast hash assumes 10 billion per second against SHA-256 or MD5. The GPU array assumes a trillion guesses per second. Each uses half the keyspace as the average number of guesses required.

Which weak patterns does it detect?

It checks against a list of the most common passwords, flags three-or-more repeated characters, detects sequences such as abc and 123, spots keyboard walks like qwerty and asdf, recognizes dates and years, and finds dictionary words even when disguised with leetspeak (for example p4ssw0rd normalizes to password). Each issue appears in the weaknesses list with an explanation.

Why does my long password still score low?

Raw length only helps when the characters are unpredictable. The checker reduces effective entropy when characters repeat and subtracts bits for each detected pattern, so something like aaaaaaaaaaaa or abcdef123456 scores far below what its length alone would suggest. Use unrelated words or random characters to keep the entropy high.

Does a high score guarantee my password is safe?

No. The score measures resistance to brute-force and common pattern attacks, but it cannot know if a password was reused, leaked in a breach, or guessed from personal information. Pair a strong, unique password with a password manager and two-factor authentication for real safety.

Password Strength Checker

Check password strength live as you type — entropy in bits, a 0-4 score, crack-time estimates across five attack scenarios, and zxcvbn-style weakness detection. Runs entirely in your browser; nothing is sent or saved.

About this ToolHow it works, benefits & use cases

Type a password and this checker scores it live, character by character, without ever sending or storing the value. It estimates Shannon entropy from the active character set (26 lowercase, 26 uppercase, 10 digits, 33 symbols), then penalizes the patterns that make real passwords weak: repeated runs, sequences like abc or 123, keyboard walks like qwerty, dates and years, and dictionary words hidden behind leetspeak substitutions. The result is a 0-4 score with a five-step label (Very weak through Very strong) above a segmented strength meter that fills as you improve the password. Below it, crack-time estimates span five attack scenarios, from a throttled online login at 100 guesses per hour up to a trillion-guess-per-second GPU cracking array. A bundled set of the few hundred most common passwords flags instantly when you type a known-breached value, and a composition breakdown counts length, character classes, and unique characters. Everything is computed in your browser and nothing is persisted or shared via URL.

How to Use

1Type or paste a password into the Password field — analysis runs instantly with every keystroke.
2Use the show/hide eye toggle to reveal the masked input when you want to verify what you typed.
3Read the segmented strength meter, the 0-4 score, and the entropy in bits at the top of the results.
4Scan the crack-time table to compare resistance across five attack scenarios from throttled online to a GPU array.
5Work through the listed weaknesses and the composition counts to see exactly what is hurting the score.
6Click Suggest a strong passphrase to fill the field with a high-entropy four-word example, or apply the suggestions and watch the meter update in real time.

Key Benefits

Live scoring on every keystroke — no submit button or page reload
Entropy in bits plus a 0-4 score and a five-level label from Very weak to Very strong
Crack-time estimates across five scenarios: throttled online, unthrottled online, slow-hash offline, fast-hash offline, and a GPU cracking array
zxcvbn-style weakness detection: common passwords, sequences, repeats, keyboard walks, dates, and leetspeak dictionary words
Bundled set of the most common passwords for instant known-breach flagging
Composition breakdown counting length, lowercase, uppercase, digits, symbols, and unique characters
One-click strong passphrase suggestion and concrete, actionable feedback
Runs entirely in your browser — the password is never saved, sent, or put in the URL

Common Use Cases

Sanity-checking a new account or master password before you commit to it
Teaching users or teammates why length and word-based passphrases beat clever substitutions
Demonstrating how quickly a common password like "password1" falls in an offline attack
Comparing candidate passphrases by entropy and estimated crack time across attack scenarios
Auditing whether a password clears a 12-plus character, multi-class policy

Password

Runs entirely in your browser — nothing is sent, saved, or put in the URL.

Start typing to see a live strength score, entropy, and crack-time estimates.

Was this tool helpful?

Share Your Experience

Help others discover this tool!

Share on