Password Strength Checker
Estimate password strength, entropy, and crack time locally.
Checked entirely in your browser — your password is never sent anywhere.
Character sets used: lowercase, uppercase, digits, symbols. Tip: length matters most — aim for 12+ characters.
Why this score
Contains "Tr0ub4dor" is "troubador" with character substitutions.
Tr0ub4dor"Tr0ub4dor" is "troubador" with character substitutions
- Make it longer — length adds more strength than any other change.
- Avoid words from a dictionary, even with letters swapped for symbols.
- Use several unrelated words (a passphrase) instead of one word with substitutions.
Time to crack, by attack
- Online, rate limited (100 / hour)
- 7 years
- Online, no rate limit (10 / sec)
- 7 days
- Offline, slow hash — bcrypt (10k / sec)
- 10 minutes
- Offline, fast hash — SHA-1 on GPUs (10B / sec)
- instantly
Estimated at 11,978,880 guesses, assuming an attacker finds it halfway through the search.
What makes a password strong
Strength is really about guessability — how many attempts an attacker needs before they hit yours. Counting character classes is a poor proxy for that, because it treats every 11-character string as equally hard: Tr0ub4dor&3 and a random 11-character string score the same, yet the first is a dictionary word with predictable letter swaps and is cracked in a fraction of the time.
So this tool instead looks for the cheapest way to describe your password — common passwords and words, names, keyboard runs like qwerty, rising or falling sequences, repeated blocks, dates and years, and letter-for-symbol substitutions — and only falls back to brute-force arithmetic for the parts that no pattern explains. That is how real cracking software works, so the estimate tracks reality far more closely. Because the built-in word lists are compact, an unusual dictionary word may still be scored as though it were random: treat the result as an upper bound on strength, never a guarantee.
Generate a strong one with the password generator, then store a hash with bcrypt or the hash generator.
Built and maintained by Meet Shah · Last updated
What this tool is used for
- Explaining to someone why the password they are proud of is weaker than a longer plain phrase.
- Sanity-checking a candidate before you commit it to a password manager.
- Comparing two approaches — random characters against a multi-word phrase — at the same typing cost.
- Demonstrating during a review how quickly a pattern-based password falls.
- Checking whether adding length or adding symbols helps more for a given starting point.
Frequently Asked Questions
- How is strength estimated?
- By guessability, not charset arithmetic — the password is matched against dictionaries, common patterns, keyboard walks and predictable letter substitutions, and scored by how many guesses a real cracker would need.
- Why is Tr0ub4dor&3 rated weak?
- Because it is xkcd 936's own example of a bad password: a dictionary word with predictable substitutions and a suffix. A naive charset calculation scores it around 72 bits and calls it strong, which is exactly the flaw this avoids.
- Why does adding a symbol barely help?
- Because appending `!` to a common word is one of the first things cracking software tries. Entropy comes from unpredictability, and a predictable transformation of a predictable base adds almost none.
- Which crack time should I pay attention to?
- The offline fast-hash figure — that is the scenario where a breached database is attacked with GPUs. Online throttled attacks are far slower, but you cannot rely on a service you do not control having throttling.
- Is my password sent anywhere?
- No. The analysis runs entirely in your browser with no network request — which is the only acceptable design for a tool like this, and worth verifying before typing a real password into any such page.
- What actually makes a strong password?
- Length and genuine randomness. Several random words, or a generated string from a password manager, beat any memorable-but-clever scheme — and using a unique one per site matters more than the strength of any single password.
Common errors and gotchas
- Reading any single crack-time figure as a prediction. It depends entirely on how the password was stored and who is attacking.
- Assuming a high score means safe. A strong password that has been reused elsewhere is still a breached password.
- Trusting a character-class score over a pattern-aware one, which is why a substituted dictionary word rates badly here.
- Adding one symbol to a predictable base and expecting a large gain. Predictability, not alphabet size, is the problem.
- Typing a real password into an unknown site. Here it stays in the page, but that is a property worth checking every time.