Password Strength Checker
Find out how strong your password really is and how long it would take to crack. Everything is computed locally in your browser — nothing is sent anywhere.
Everything is calculated locally in your browser. Your password is never sent, stored, or logged anywhere.
Length
0
Entropy
—
Time to crack
—
Estimate assumes a character pool of 0 and an attacker testing 10,000,000,000 guesses per second against a fast-hashed, stolen password database.
Long, unique passwords are only practical with a password manager that generates and stores them for you.
See the tools we recommend for small teams →Browse all expert-tested tools →How password strength works
Attackers rarely guess passwords one at a time. When a database leaks, they run billions of guesses per second against the stolen hashes. The only defence is entropy: the sheer number of possible combinations your password could be. Every extra character multiplies that number, which is why a long passphrase beats a short, cryptic string almost every time. This tool measures that entropy in bits and translates it into a plain-English crack-time estimate.
The catch is that strong, unique passwords are impossible to remember for every account. That is what password managers are for — they generate and store maximum-entropy passwords so you never reuse one. While you are auditing your stack, our SaaS Cost Calculator will tell you what all those logins are costing you.
Frequently asked questions
Is my password sent anywhere?+
No. This checker runs entirely in your browser using JavaScript. Your password is never transmitted over the network, stored, or logged. You can even disconnect from the internet and it will still work.
How is password strength measured?+
We estimate entropy in bits, which measures how unpredictable a password is. The character pool is 26 for lowercase, 26 for uppercase, 10 for digits, and 32 for symbols. Entropy equals the password length multiplied by the base-2 logarithm of that pool size. More length and more character types both raise entropy.
How is the crack time estimated?+
We assume an attacker with a stolen, fast-hashed password database testing about 10 billion guesses per second. Crack time is the total number of possible combinations (pool size raised to the password length) divided by that guess rate. It is a rough estimate — a strong, unique password should show a crack time measured in centuries.
What makes a password strong?+
Length matters more than complexity. A long passphrase of random words often beats a short string of symbols. Aim for at least 60 bits of entropy — roughly 12+ random characters mixing cases, numbers, and symbols — and never reuse passwords across accounts. A password manager makes this effortless.