Entropy estimation
H = bits from detected patterns + uncovered characters × log₂(character pool size)
Password strength checker
Analyse a password live as you type: estimated entropy, penalties for common passwords, keyboard sequences, repeats, sequences and dates, a level from very weak to very strong, online and offline time to crack, and concrete advice. Nothing leaves your browser.
- Clipboard
Strength-
Estimated time to find it
- Online attackService limiting attempts (10 per second)
- Offline attackStolen fast hash, 10 billion guesses per second
Weaknesses found
Advice
Local estimate: the password is not sent and is not checked against data breaches. Use a unique password for each service.
Was this tool useful?
How does this tool work?
This checker estimates how strong a password is while you type it, taking into account the patterns attackers try first. It is for people who want to judge a password before adopting it and for teams running security awareness, with a level, an entropy, a time to crack and advice.
The tool first computes a base entropy with the formula length × log2(alphabet size), the alphabet being inferred from the character types present: 26 lowercase, 26 uppercase, 10 digits and symbols. It then penalises predictable patterns: presence in the list of the most common passwords, keyboard sequences such as qwerty, azerty or 12345, repeated characters (aaaa), alphabetical or numeric sequences (abcd, 6789), years and dates. So Qwerty2024! has 11 characters and 4 types, but it combines a keyboard walk and a year, two things attack dictionaries try immediately, and its estimate drops sharply. The result is a level from very weak to very strong, together with the estimated entropy in bits.
The time to crack is the number of combinations (2 to the power of the entropy) divided by a guessing speed, in two scenarios. Online, the attacker goes through the login form, limited to a few attempts per second by rate limiting or lockout. Offline, they have stolen a database of fast hashes (MD5, SHA-1, unsalted SHA-256) and test 10 billion passwords per second, roughly what a GPU cracking rig achieves. A random password of 8 lowercase letters (about 2 × 10¹¹ combinations) therefore holds for centuries online but about twenty seconds offline. This is an estimate, not a guarantee: the tool does not check whether the password appears in a data breach, because it makes no network call.
How to use this tool
Enter the password
Type or paste the password into the masked field; use the show/hide button to check what you typed. The analysis updates with every character.
Read the diagnosis
Look at the level (very weak to very strong), the estimated entropy in bits and the two times to crack: a throttled online attack and an offline attack at 10 billion guesses per second.
Apply the advice
Follow the recommendations shown, for example making the password longer or removing a year or keyboard sequence, then test again until you reach a satisfying level.
Entropy estimation
Use cases
Validate a master password
Before adopting the main password of your password manager or computer login, check that it reaches the very strong level and does not rely on a keyboard walk or a personal date.
Run a security awareness session
Show live why Password2024! or Qwerty123 fall in seconds offline while a long passphrase holds, to convince colleagues to change their habits.
Compare two password strategies
Test a short password full of substitutions, such as Tr0ub4dor&3, next to a passphrase of four random words to see which one really wins in entropy and time to crack.
Examples
Detect a common password
Input
Password to check: passwordResult
8 characters, lowercase letters only; 10 bits of entropy. Weaknesses found: One of the most used passwords. Advice: Make it longer: aim for at least 15 characters when the password is your only authentication factor. Prioritise length and unpredictability; adding one uppercase letter, digit or symbol does not make a short password strong. Avoid common passwords, even with substitutions such as @ for a. Prefer a passphrase of several random words, or a generated password.Tips and best practices
- Swapping letters for digits or symbols (p@ssw0rd) does not fool cracking tools, which apply these substitutions automatically: make the password longer instead.
- On a shared or work computer, test a variant with the same structure rather than your real password, simply as a precaution against installed extensions or software.
- A very strong level does not protect a password reused on several sites: if it leaks from one of them, every account is exposed. Use a unique password per site and turn on two-factor authentication.
Sources and references
Frequently asked questions
Is it risky to type my password into an online checker?
With this checker, the password is analysed by code running in your browser and is never transmitted: no network request is sent during the analysis. As a general precaution, still avoid typing a real password on a device you do not control.
How long would it take to crack my password?
It mostly depends on the scenario. Online, attempt limits make even an average password hard to guess; offline, after stealing a database of fast hashes, an attacker can test 10 billion passwords per second. The tool shows both estimates, which assume the password is not already known.
Does the tool check whether my password has been leaked?
No, it makes no network call and queries no breach database. For that, use a service such as Have I Been Pwned’s Pwned Passwords, which only compares a prefix of the SHA-1 hash (k-anonymity); a password found in a breach must be changed whatever its score.
What makes a password strong?
A strong password is long, unpredictable and unique: at least 15 characters according to NIST SP 800-63B-4 when used on its own, with no obvious dictionary word, date, name or keyboard walk. A random password from a generator or a passphrase of several randomly chosen words meets these criteria.
Is adding a capital letter and a digit at the end enough?
Rarely. A leading capital, a digit or year at the end and a final exclamation mark are exactly the transformations cracking rules try first. The tool detects years and sequences in particular; a few extra random characters help far more.
Why does my score differ from another checker?
Each checker uses its own model: dictionary size, detected patterns, assumed attack speed. Results are estimates and can vary from one tool to another; focus on the patterns flagged and the order of magnitude of the time to crack.
Related tools
Keep going with these tools
Tools similar or complementary to this one.
Similar tools
Generate strong random passwords from 8 to 128 characters, with the entropy shown.
Security & privacyFeaturedUse this tool
Create a modern password policy: length, blocklists, passphrases, expiration and attempt limits.
Security & privacyUse this tool
Derive a salted PBKDF2-SHA-256 or SHA-512 password hash, or verify a password against an encoded value.
Security & privacyUse this tool
Read next
GuideBest practicesBeginner
Passwords: generation, strength and useful policies
Understand why length and uniqueness matter, how password managers, MFA and passkeys complement passwords, and how servers should store them.
29 August 20262 min
GuideBest practicesBeginner
Web security: understand the essential protections of a website
Understand the layers that protect a website: HTTPS, HTTP security headers, CSP, SRI, authentication, passwords and integrity.
29 August 20262 min
GuideBest practicesIntermediate
OAuth 2.0, PKCE, JWT, JWK and JWKS: understand their roles
Understand how OAuth 2.0, PKCE, JWT, JWK and JWKS fit together: authorization, tokens, public keys and verification.
23 September 20262 min
TutorialBest practicesBeginner
How to securely redact a PDF before sharing it
Learn why covering text is not enough, how secure PDF redaction removes sensitive information and why sanitization matters before sharing.
10 September 20262 min