Password Strength Checker
Test any password for strength, entropy, and estimated crack time. The tool evaluates password length, character variety, common patterns, keyboard walks, sequential characters, repeated characters, and matches against common password lists. Crack time estimates cover three attack scenarios: online throttled (100 guesses per second), online unthrottled (10,000 guesses per second), and offline GPU cracking (100 billion guesses per second). All analysis runs entirely in your browser \u2014 your password is never sent to any server, never stored, and never logged.
Why Password Strength Matters
Weak passwords are responsible for over 80% of data breaches. Common words, personal information, and predictable patterns (like "Password123!" or "Summer2024") can be cracked in seconds by modern GPU clusters. A strong password uses length, character variety, and avoids dictionary words and patterns. Each additional character multiplies crack time \u2014 a 16-character password with mixed types takes centuries to crack, while an 8-character one can fall in minutes.
See also: After evaluating password strength, the Encrypted Notepad stores notes encrypted client-side under that password.
Common Use Cases
Auditing your own password manager's entries to identify the ones that need rotation, where the manager itself tells you "weak" but doesn't explain why. Generating a personal sense of what a passphrase "feels like in entropy terms" before committing it to memory for a high-value account. Teaching a non-technical family member why their pet's name plus a birth year is not a strong password, with a visible score they can react to.
Validating a password-policy proposal before locking it into a corporate IT standard — some common policies (forced quarterly rotation, no special characters) actively reduce password strength when graded against modern research. Spot-checking the strength of passwords surfaced in a security audit to triage which ones need immediate replacement. Estimating realistic crack times for offline vs online attack scenarios on candidate passwords.
How We Compare
Most modern password managers (1Password, Bitwarden, Dashlane) include their own strength gauges and will flag weak entries. They're the right tool when the password is already in the manager. For a quick "is this candidate strong enough" check on a password you haven't committed to yet, or for teaching scenarios, a standalone checker is faster than the round-trip through a vault.
This tool uses zxcvbn-style heuristics (dictionary checks, pattern detection, keyboard-walk recognition, repeated-character penalties) plus an entropy estimate, and reports both a score and a plain-language explanation of why the score is what it is. The password is never sent anywhere — all scoring runs locally in your browser, so even "test" passwords stay on your device. For generating fresh random secrets to replace weak ones, see env generator.
Frequently Asked Questions
Built by Derek Giordano \u00B7 Part of Ultimate Design Tools
Privacy Policy \u00B7 Terms of Service