Password Strength Checker
Get a rough estimate of how hard a password is to guess. Nothing you type leaves this page or is stored.
Type a password above. Nothing is sent or saved: the check runs inside this page.
Private: Everything runs in this page. Nothing you type is sent anywhere or saved.
On this page
Example estimates (do not use these passwords)
| Example | Verdict | Estimated bits | What it found |
|---|---|---|---|
| password | Very weak | 1.6 | common password |
| 123456 | Very weak | 1 | common password |
| Summer2024 | Very weak | 14.7 | common password, first-letter capital, ends in a year |
| Jennifer1990! | Very weak | 21.6 | common name, first-letter capital, ends in a year, word + digits + symbol |
| iloveyou2024! | Very weak | 16.4 | common password, ends in a year, word + digits + symbol |
| blue tiger marches past nine lamps | Very strong | 83.5 | common password, passphrase |
| tangerine glacier cobalt wrench plankton | Strong | 73.5 | passphrase |
| k8#Qz!4vR@2mLp9$ | Very strong | 105.1 | no common pattern |
Formula
Look-alike swaps add 1 bit plus 0.5 per swapped character, and capital letters add 1 bit or more. Digits or symbols added after a word cost about 3.3 bits each, and a repeated chunk costs the chunk plus log2(times) + 1. Bands: under 28 bits Very weak, under 36 Weak, under 60 Fair, under 80 Strong, 80 or more Very strong. Caps: only 1 to 3 common parts (plus digits or symbols) = Weak at most; 60 percent or more common parts = Fair at most; under 8 characters = Weak at most. Word-like text that is not on the lists never triggers a cap by itself. Words, names and swaps are reported only when a listed word was found; a listed word of 3 or 4 letters, a run or repeat of 3, a 4-digit date and a 4-letter keyboard row count only when they make up 30 percent or more of the password, so random strings are not given false notes. These numbers were chosen for this site; they are not an official standard.
How the password strength checker works
- Step oneType or paste a password. Use the Show box to see what you typed.
- Step twoThe tool looks for common parts: very common passwords, common words and first names, month and day names, years from 1900 to 2099, date shapes, runs such as abc or 123, repeats such as aaa or abcabc, keyboard rows such as qwerty, and look-alike swaps such as @ for a or 0 for o. It also notices digits and symbols added after a word.
- Step threeIt then finds the cheapest way to build your password from those parts plus random characters, and adds up the bits. A common part costs only a few bits; every other character costs log2 of the size of the character set you used.
- Step fourThe Weak cap applies only to a password made of one to three common parts (listed words, names, years, dates, runs, repeats or keyboard rows) plus digits or symbols: it is never rated higher than Weak. One that is 60 percent or more common parts is never rated higher than Fair. Four or more unrelated words, with or without spaces between them, are counted as a passphrase: words not on the lists cost about 11 bits each when run together and 13 when clearly separated, so such a phrase is not capped. Read the verdict and the list of what was found. Treat it as a guide, not a guarantee.
What this tool does not do
- It is a rough estimate. It cannot know whether your password has leaked or been reused.
- It cannot know your own details, such as a name, a pet or a birthday, unless they are on its lists.
- It knows a few hundred common passwords, words and first names plus patterns such as years, dates, runs and keyboard rows.
- A rare name or phrase it does not know is counted as ordinary text or as random characters.
- A random string of lowercase letters that happens to look like words is sometimes rated lower than it deserves, and a phrase of words typed together is counted at about 11 bits a word, a cautious figure.
- The rough time to guess is shown only when no pattern was found, and it assumes ten billion guesses per second.
- Only the first 128 characters are checked for patterns. Nothing you type is sent or stored.
Frequently asked questions
Is my password sent to a server?
No. The check runs inside this page, with no network request, and nothing is stored. Still, do not type a password you use today on any site you do not trust.
Why does a name plus a year rate so low?
Guessers try common passwords, first names, words and years before anything else, so a name, a year and a symbol is only a few bits of work for them, however long it looks. The checker finds those parts and says which ones it found.
Why is a long phrase often better than a short complex password?
Every extra random character or unrelated word multiplies the work for a guesser. A phrase of unrelated words is easy to remember and has many characters. Words chosen by you from a short list of common words count for little.
What does the rough time to guess mean?
It is shown only when no pattern was found. It assumes the characters were chosen at random from the character set you used, and a fast offline attack of ten billion guesses per second against a leaked, quickly hashed password. Those are assumptions for comparison, not a measurement of any real attacker. When a pattern was found, a guesser would try that pattern first, so a time worked out from the length would mislead and none is shown.
Is a phrase of words with no spaces rated fairly?
Yes, within limits. Four or more words run together are counted as a passphrase and estimated from their letters: about 11 bits per 5.5 letters, which is cautious. Six unrelated words typed together reach Strong or better. Words that are on the built-in lists cost less, and one to three common words in a row are still rated Weak, because guessers try those first.
Can I trust a good rating?
Only as a rough guide. The tool knows a few hundred common passwords, words and first names and a handful of patterns. It cannot know a password that has leaked, one you reuse, or one that holds your own details. A word it does not know may be rated as random text.