Password Strength Checker
Check how strong a password really is: estimated entropy, how long it would take to crack in different attack scenarios, and the patterns that weaken it — common passwords, dictionary words, keyboard runs, repeats and dates. Optionally check known breaches without revealing the password.
This tool runs entirely in your browser.
How to use the Password Strength Checker
- 1Type a password — it is checked as you type and never leaves the page.
- 2Read the rating, crack-time estimates and the patterns that make it weaker.
- 3Optionally click “Check known breaches” to see if it appeared in leaked password lists.
What is the Password Strength Checker?
Attackers don’t guess randomly: they try leaked passwords, dictionary words with common substitutions (P@ssw0rd), keyboard runs (qwerty), names and dates first. So the checker starts from the character-pool entropy and lowers it for every predictable pattern it finds, then estimates crack times for a rate-limited online attack, an offline attack on a slow hash like bcrypt, and an offline attack on a fast hash.
The breach check is opt-in and uses Have I Been Pwned’s k-anonymity range API: your browser computes the SHA-1 hash, sends only its first 5 characters, receives every leaked hash starting with them, and compares the rest locally. Neither the password nor its full hash is sent. For the best protection use a long random password or passphrase per site in a password manager, plus two-factor authentication.
Frequently asked questions
Is it safe to type my real password here?
The check runs in your browser and nothing is sent unless you click the breach check, which sends only a 5-character hash prefix. Still, the safest habit is to test a similar password, not your real one.
How long should a password be?
At least 12 characters, ideally 16+ or a passphrase of four or more random words. Length beats complexity.
Is the Password Strength Checker free and private?
Yes. The Password Strength Checker is free, needs no account, and runs entirely in your browser. What you type is never sent to a server or stored.
Related tools
All security & generators →- Password GeneratorGenerate strong, random passwords.
- Passphrase GeneratorGenerate memorable multi-word passphrases.
- Bcrypt Hash GeneratorHash passwords with bcrypt and verify hashes.
- TOTP / 2FA Code GeneratorLive 2FA codes from a secret key or otpauth link.
- SHA-256 GeneratorGenerate SHA-256 hashes of text or files.
- Random Number GeneratorPick random numbers in any range.