Skip to content
tecuy
Design & Utility

Password Strength Checker

Estimate a password's entropy and check it against common-password patterns — entirely in your browser, nothing is sent anywhere.

This runs entirely in your browser. Nothing you type is sent anywhere. The estimate spots common words, sequences, keyboard runs, repeats and years, but not names, other dictionary words or leaked passwords — treat it as a guide, not a guarantee.

Very weak~0 bits of entropy
  • At least 12 characters
  • Contains a lowercase letter
  • Contains an uppercase letter
  • Contains a number
  • Contains a symbol
  • No common words or predictable patterns

Need a strong password?

Click generate to create one

How to use the Password Strength Checker

  1. Type or paste a password into the Password field.
  2. Click Show if you want to see the characters you typed, and Hide to mask them again.
  3. Read the strength label and the approximate bits of entropy under the meter.
  4. Check the warning box for predictable parts, then the six criteria to see which ones the password meets.
  5. To get a new password, click Generate under Need a strong password? and use Copy to copy it.

Example: Why a symbol doesn't rescue a common word

Entering Password1 gives Very weak and ~10 bits, because it is on the built-in common-password list. Entering Password1! is still Very weak at ~19 bits: the tool lists Password as a common password word, so only the 1 and ! are scored as random characters.

Questions about the Password Strength Checker

How is the entropy number calculated?
Two estimates are made and the lower one is shown: length × log2 of the character pool (26 lowercase, 26 uppercase, 10 digits, 33 other), and a pattern score where common words, sequences, keyboard runs, repeats and years cost only a few bits each. A password on the common-password list is capped at 10 bits.
Does a Strong label mean the password is safe to use?
Not necessarily. The tool spots common password words (including P@ssw0rd-style spellings), sequences like abc or 123, keyboard runs like qwerty, repeated characters and years, but not names, other dictionary words or leaked passwords. It does not check breach databases.
Why does a long passphrase score Very strong without numbers or capitals?
Length counts more than variety in this formula. correct horse battery staple is 28 characters, and the spaces count as symbols, so it reaches about 165 bits even though it has no uppercase letters or digits.
What does the Generate button produce?
A 16-character password drawn evenly from letters, digits and the symbols !@#$%^&*()-_=+ using your browser's crypto.getRandomValues. It is created locally and is not sent or stored anywhere.