Home › Security Tools › Password Strength Checker

Password Strength Checker

See how strong a password is, from its length and character types: the entropy in bits, a strength label, and an estimated crack time. Runs in your browser.

Nothing you type is sent, stored or copied. The field is cleared when you leave this page.
Limits. The estimate assumes a random password. It cannot see dictionary words, names, dates or keyboard patterns, so a readable password can score high. It does not check against known breached passwords. Treat a high score as a starting point, not a guarantee.
Type a password to check it.
Entropy (estimate)-
Strength-
Estimated crack time at 10 billion guesses per second-
Average guesses needed-

How it works

Entropy is the length of the password multiplied by the base-2 logarithm of the size of the character set. The set is the sum of the character types the password uses: lower-case letters (26), upper-case letters (26), digits (10), symbols (32, the printable ASCII punctuation), and spaces or other characters (33). Entropy is shown to one decimal place.

Strength is set by the entropy: below 28 bits is very weak, below 36 is weak, below 60 is reasonable, below 80 is strong, and 80 or more is very strong.

Crack time assumes an attacker who has to try, on average, half of all the possible passwords. The page divides that count by a fixed rate of 10 billion guesses per second. That rate is an assumption for illustration, not a measurement of any real attack. A slow, salted password hash used by a site makes real attacks far slower.

Advice names the weakest character type the password uses, and the types it does not use.