Password Strength Checker
Estimate password entropy, identify weak patterns, and compare crack-time assumptions in your browser.
Use the checker for education and sample policy testing, then rely on a password manager for real account credentials.
How Password Strength Checking Works
Password strength checking estimates how many guesses an attacker may need before finding a password. A simple brute-force model uses the size of the character set and the password length, but real attackers do not guess uniformly at random.
Practical guessing starts with leaked password lists, dictionary words, keyboard paths, years, substitutions such as a for @, and repeated characters. This tool combines a basic entropy estimate with pattern checks so weak human habits are not treated as truly random.
The crack-time estimates are intentionally approximate. Online systems may limit guesses to a few attempts per minute, while offline attackers with stolen password hashes can test large numbers of guesses if weak or fast hashing was used.
Length
Every extra random character increases the search space. A long passphrase often beats a short password with predictable substitutions.
Randomness
Attackers try common passwords, names, keyboard walks, and substitutions before brute force. Human-made patterns lower real strength.
Hashing context
Offline attacks against fast hashes are very different from online login attempts protected by rate limits and lockouts.
History and Modern Guidance
Early password advice often required short passwords with uppercase letters, digits, and punctuation. That created many predictable variants such as Password1!, which attackers learned to try early.
Modern guidance focuses more on length, resistance to known breached passwords, throttled online guessing, and secure password storage. NIST guidance also discourages arbitrary periodic password changes unless there is evidence of compromise.
For applications, password strength checking is only one layer. Passwords should be hashed with a dedicated password-hashing function, protected by multi-factor authentication where appropriate, and never stored or logged in plaintext.
Use Cases
Password policy testing
Check whether a sample password policy rewards length and avoids obvious weaknesses.
Security education
Demonstrate why password123, keyboard walks, and repeated characters are easier to guess than random passphrases.
Passphrase comparison
Compare memorable passphrase samples against shorter complex-looking passwords.