About the Password Strength Checker
This password strength checker estimates how hard a password is to guess. It measures the classic character-set entropy — length × log₂ of the pool of characters used — and then adjusts it for the shortcuts real cracking tools take: passwords from leaked lists, dictionary words (even with leetspeak like P@ssw0rd), years such as 2024, repeated characters, alphabet or number sequences and keyboard runs like qwerty. The adjusted figure is what drives the rating and the estimated time to crack.
Choose an attack scenario to see the difference between an online attacker who is rate-limited by a login form and an offline attacker with a stolen password database, where a fast unsalted hash on GPUs can test billions of guesses per second but a slow hash such as bcrypt cuts that to thousands.
The check runs entirely in your browser — nothing you type is sent anywhere — but as a rule never type a password you currently use into any website. The estimate is a heuristic, not a guarantee: a password reused on a breached site is weak however long it is, so use a password manager and unique passwords everywhere.
How to use the password strength checker
- 1Type a sample password — avoid entering one you actually use.
- 2Pick the attack scenario that matches your threat.
- 3Read the strength rating, adjusted entropy and time to crack.
- 4Fix the weaknesses listed: remove words, years and sequences, and add length.
Formula and method
Character-set entropy H multiplies the length L by log₂ of the pool size R: 26 for lowercase, +26 uppercase, +10 digits, +33 ASCII symbols and space, +100 if non-ASCII characters appear. It assumes every character was chosen at random, which people rarely do.
The adjusted entropy H′ replaces predictable parts with what an attacker would actually need: an exact match with a top leaked password counts as 10 bits; each dictionary word (after undoing leetspeak) counts as 16 bits, +1 if capitalised or substituted; a year 1900–2099 counts as log₂(200) ≈ 7.6 bits; and a character that continues a repeat, a ±1 sequence or a keyboard row (the third character onward) counts as 1 bit. Every other character keeps log₂(R) bits. Average crack time is half the search space divided by the guessing rate. Ratings: under 28 bits very weak, 28–35 weak, 36–59 fair, 60–127 strong, 128+ very strong.
- H
- Character-set entropy in bits
- H′
- Pattern-adjusted entropy in bits
- L
- Password length in characters
- R
- Size of the character pool used
Worked examples
A typical “complex” password
Summer2024! uses all four character classes (pool 95), so the naive estimate is 11 × log₂95 ≈ 72.3 bits. But “summer” is a dictionary word (16 + 1 bit for the capital), 2024 is a year (7.6 bits) and only ! adds a full 6.6 bits — about 31 bits in total, which a GPU rig cracks in well under a second.
Repeated characters
Eight lowercase letters look like 8 × log₂26 ≈ 37.6 bits, but after the first two a’s every character just repeats: 2 × 4.70 + 6 × 1 ≈ 15.4 bits.
A random 16-character password
No words, years or runs are found, so the full 16 × log₂95 ≈ 105.1 bits counts. Even against a stolen database guessed at a fast 10,000 per second, 2^104 guesses would take far longer than the age of the universe.
A leaked password
“password” is near the top of every leaked-password list, so attackers try it within the first few hundred guesses. It is rated at 10 bits however long the character-set estimate says it is.
Frequently asked questions
How many bits of entropy should a password have?+
For accounts protected by a slow hash and rate limiting, 50–60 bits is reasonable; for anything that could face an offline attack with a fast hash, aim for 70–80 bits or more. A random 16-character password from all 95 printable characters gives about 105 bits.
Is it safe to type my password here?+
The checker runs only in your browser and sends nothing over the network, but it is good security hygiene never to type a live password into any website. Test a password with the same structure instead, for example swapping each letter for another.
Are long passphrases better than complex passwords?+
Usually yes. Four to six words picked at random from a large list give 50–80 bits and are easy to remember, while a short “complex” password like Summer2024! follows patterns crackers try first. Length beats symbol substitution.
What does NIST recommend for passwords?+
NIST SP 800-63B (Revision 4, August 2025) requires passwords of at least 15 characters when used as the only factor and at least 8 when part of multi-factor authentication, says verifiers should allow at least 64, requires screening against breached and common passwords, and forbids composition rules such as mandatory symbols.
Why does the time to crack change so much between scenarios?+
It depends on how fast an attacker can test guesses. A login form that locks after a few attempts allows perhaps 100 guesses an hour, while an offline attack on unsalted MD5 or SHA-1 hashes with GPUs can exceed 10 billion per second — a factor of more than 10¹¹.