Password Strength Checker

Password strength is a measure of how difficult it is for an attacker to guess or crack a password through automated means. A strong password resists dictionary attacks, brute-force attempts, and pattern-matching techniques that modern cracking tools use at billions of guesses per second. Understanding what makes a password strong — and being able to measure it objectively — is one of the most practical steps you can take to improve your personal and organizational security.

Weak passwords are the most common vector for unauthorized account access. Data breach analyses consistently show that huge proportions of compromised accounts used passwords like "123456", "password", "qwerty", or simple first-name combinations. These passwords are cracked in milliseconds using freely available wordlists. Even slightly more complex passwords that rely on predictable patterns — replacing "a" with "@", appending "1" to a word — offer little resistance against modern attacks that specifically account for these substitutions.

This password strength checker evaluates your password across nine distinct criteria, then calculates two key security metrics: entropy (measuring unpredictability in bits) and an estimated crack time assuming an attacker makes 10 billion guesses per second — a realistic speed for offline attacks using dedicated hardware. Together these metrics give you a quantitative picture of your password's real-world security, not just a vague color rating.

The tool runs entirely in your browser. Your password is never transmitted to any server, never logged, and never stored. Every calculation is performed locally using JavaScript, making this a safe tool to use even for real passwords you rely on.

The password strength score is a point-based system that awards points for meeting each of nine distinct security criteria. Points accumulate up to a maximum of 100. The final score is mapped to one of five strength labels: Very Weak (0–29), Weak (30–49), Fair (50–69), Strong (70–84), and Very Strong (85–100).

The nine criteria and their point values are:

The maximum achievable score is 100. A password meeting all nine criteria receives full marks. Strength thresholds are: scores 0–29 are Very Weak, 30–49 are Weak, 50–69 are Fair, 70–84 are Strong, and 85–100 are Very Strong. Both the "no repeated characters" check and the "no common patterns" check are penalty-avoidance criteria — you earn points by not having these problems rather than by adding something new.

Beyond the score, this password strength checker computes two quantitative security metrics: entropy and estimated crack time. These numbers give you a direct, math-based view of how unpredictable your password is and how long it would take a powerful attacker to guess it.

Entropy is measured in bits and represents the theoretical unpredictability of the password given the character sets it uses. It is calculated as:

entropy = ⌊ length × log₂(charsetSize) ⌋

where charsetSize is the total number of distinct characters available based on which character pools your password draws from: lowercase letters add 26, uppercase letters add 26, digits add 10, and special characters add 32. A password using all four pools has a charsetSize of 94. Entropy measures the size of the search space an attacker must cover — every additional bit of entropy doubles the number of possible passwords.

As a practical guide: passwords with fewer than 40 bits of entropy are considered weak against offline attacks; 60–80 bits provides reasonable medium-term protection; 80+ bits is strong against even future hardware advances.

Crack time estimates how long a brute-force attack would take, assuming 10 billion (10¹⁰) guesses per second — a realistic speed for a dedicated offline attack using modern GPU hardware. The formula is:

seconds = charsetSize^length ÷ 10,000,000,000 ÷ 2

The division by 2 reflects that an attacker on average finds the password halfway through an exhaustive search. The result is expressed in the most human-readable unit: seconds, minutes, hours, days, months, years, or "Centuries+" when the estimate exceeds roughly 100 years. Crack time grows exponentially with both password length and charset size, which is why adding just a few more characters or one more character type can shift the estimate from days to centuries.

One of the most counterintuitive aspects of password security is how dramatically the choice of character set affects resistance to attack. The search space — the total number of possible passwords an attacker must check — grows as charsetSize^length. This exponential relationship means that small increases in either the charset or the length produce huge improvements in security.

Consider a 10-character password. If it uses only lowercase letters (charset 26), the search space is 26¹⁰ ≈ 141 trillion combinations. If you add uppercase letters (charset 52), the search space becomes 52¹⁰ ≈ 145 quadrillion — about 1,000 times larger. Add digits (charset 62) and you reach 62¹⁰ ≈ 839 quadrillion. Include special characters (charset 94) and the space expands to 94¹⁰ ≈ 54 quintillion. All from the same 10-character password, just by expanding the character pool.

Length has an even more dramatic effect because it is the exponent. Moving from 10 to 12 characters with a full 94-character set increases the search space by a factor of 94² = 8,836. Moving from 10 to 16 characters multiplies the space by 94⁶ ≈ 689 billion. This is why security guidelines consistently emphasize length as the single most impactful factor in password strength.

This is also why "character substitution" rules — like replacing "e" with "3" or "a" with "@" — provide far less protection than they appear to. Attackers' tools apply these transformations automatically. A truly strong password uses genuine randomness across a wide character set, not a predictable transformation of a dictionary word.

The checker categorizes your character pools automatically: it detects if you have used at least one lowercase letter, one uppercase letter, one digit, and one symbol. Use all four pools and you unlock the full 94-character charset, which gives the most entropy per character of any commonly available character set.

Understanding what the password strength checker flags as problems is the first step toward building better password habits. The most common mistakes fall into a handful of predictable categories that attackers exploit first.

Using common words and patterns. The checker tests for substrings like "password", "123456", "qwerty", "abc123", "letmein", "admin", and "welcome". These appear in every public breach wordlist and are tested in the first fraction of a second of any dictionary attack. Including any of these as part of your password — even wrapped in other characters — eliminates 15 points from your score and gives attackers a huge shortcut.

Relying on length alone. A 16-character password made entirely of lowercase letters like "abcdefghijklmnop" scores points for length but fails to use uppercase, numbers, or symbols. Each missing character type reduces the charset and thus the entropy and crack time. A 16-character lowercase-only password (charset 26) has entropy of ⌊16 × 4.70⌋ = 75 bits — decent, but a 12-character all-four-pools password has entropy of ⌊12 × 6.55⌋ = 78 bits and benefits from much greater per-character unpredictability.

Repeated characters. Passwords containing runs of three or more identical characters (like "aaa", "111", or "!!!") reduce effective entropy. The checker's regular expression /(.)\1{2,}/ detects these patterns and deducts 10 points. Real-world cracking tools specifically probe repeated-character patterns early in their runs.

Using the same password across multiple sites. Even a Very Strong password becomes a liability when reused, because a breach at one site exposes it at every other site. The solution is a password manager that generates and stores unique strong passwords for every account — reducing the burden on human memory while increasing security across the board.

Short passwords with symbol substitutions. "P@ss1!" is 6 characters. Despite using all four character pools, it scores Very Weak because it falls far short of the minimum length thresholds and the crack time at full charset is still only a matter of hours on modern hardware. Length and diversity work together — you need both.

Consistently creating passwords that score Strong or Very Strong on the checker is straightforward once you understand the criteria. The following practices address each of the nine scored criteria and align with current guidance from NIST, OWASP, and major security researchers.

Prioritize length above all else. Aim for at least 16 characters for any important account. Length is the most powerful lever in the strength formula because it is the exponent in the search space calculation. A 16-character password with all four character pools achieves Very Strong status (entropy ≈ 104 bits, crack time in the centuries) even before considering other factors.

Use all four character pools. Include at least one lowercase letter, one uppercase letter, one digit, and one special character. This maximizes your charset to 94 and earns you 45 of the possible 100 score points from character-type criteria alone. Avoid putting the uppercase letter only at the start or the number/symbol only at the end — spread them throughout.

Avoid predictable patterns and common words. Don't start with a capitalized word, don't end with a digit or year, and don't include dictionary words — even with obvious substitutions. Consider using a random passphrase of 4–5 unrelated words (like XKCD-style passwords) or a fully random string generated by a password manager.

Use a password manager. Tools like Bitwarden, 1Password, or KeePass generate cryptographically random passwords of any length and character set, store them securely, and fill them in automatically. This removes the human tendency to create memorable — and therefore guessable — passwords.

Enable multi-factor authentication (MFA). Even the strongest password can be phished or leaked in a breach. MFA adds a second verification step — a time-based code, hardware key, or biometric — that protects your account even if your password is compromised. MFA and strong passwords together form the baseline of modern account security.