About this tool
Password strength test, explained
Test a password against the patterns attackers try first and see how long it would hold against five kinds of attack, or generate a strong password or passphrase. Everything runs in your browser: the password is never sent anywhere.
How to use it
- 1On the Test a password tab, type or paste into the Password field. It is masked; click Show to read it.
- 2Read the rating on the five-segment bar, from Very weak to Very strong, with the bits and the character count beside it.
- 3Check Time to crack and the five attackers under it, then the Checklist and the Patterns found.
- 4Need a better one? Open Generate one, choose Random characters or Passphrase, then click Copy, New one or Test it.
How it works
How the strength is estimated
First, the whole password is checked, ignoring capitals, against a short list of the most used passwords such as 123456 or letmein. A match is rated Very weak and cracked Instantly, whatever its length.
Otherwise it is split into the patterns cracking tools try first: dictionary words of four letters or more (leetspeak included), a common password used as a prefix, keyboard walks such as qwerty, sequences such as 1234, repeats, dates and years. Each pattern costs only what it takes to guess, and every other character costs log2 of the character pool: lowercase 26, uppercase 26, digits 10, symbols 33. Under 28 bits is Very weak, under 36 Weak, under 60 Fair, under 128 Strong, and 128 or more Very strong.
On average an attacker finds the password halfway through, so time to crack is 2^bits / 2 divided by the guessing speed, from 100 guesses an hour on a rate-limited login page to 1 trillion a second on a GPU cluster. The headline uses 10 billion a second, a stolen database with a fast hash. The starting example, summer2024, scores about 18 bits instead of 52: instant from a database, about 44 days through a rate-limited login.
The generator uses your browser's cryptographic random source and includes every character set you tick. A passphrase draws from a list of 436 short words, about 8.8 bits each, plus about 6.6 bits for the added number.
Bits = cost of each pattern + log2(pool) per remaining character. Time to crack = 2^bits / 2 / guesses per second
When to use it
Ways people use it
Choosing a new password
Compare two or three candidates and keep one that reaches Strong with no dictionary word, date or keyboard walk left in the checklist.
Writing a password policy
Use the attacker table to set a minimum length: a login page with rate limits needs far fewer bits than a password hash that could leak.
Generating a passphrase people can type
Pick Passphrase, the number of words and a separator, then send the settings with Share link. The link carries the generator options only, never a password.
FAQ
Questions people ask
Is it safe to type my password into a password checker?
Only if the checker runs locally. This one works in your browser with no network request, and never puts the password in the page address or the share link.
How long should a password be?
The checklist asks for at least 12 characters, ideally 16 or more. Length only helps when the characters are random, so make sure no word, date or keyboard pattern does the work.
What is password entropy?
Entropy measures the guesses needed, in bits: each extra bit doubles the search. Plain entropy treats every character as random and overrates words or dates, so this tool counts those patterns at their real cost.
Are passphrases better than complex passwords?
Random words are easier to remember and type. Each word adds about 8.8 bits, so six words with a number reach about 59 bits (Fair) and seven pass 60 (Strong), which is why the generator starts at seven.
Why does my password show as cracked instantly?
Either it is on the list of the most used passwords, or its patterns leave so few bits that 10 billion guesses a second find it in under a second. Patterns found shows which part is to blame.