Password Strength Checker
How strong is your password really? Estimate its entropy and how long an offline attack would take to crack it — without it ever leaving your browser.
Never leaves your browser — nothing is sent, logged, or stored.
Enter your values to see the result.
How it works
The checker estimates the “character pool” your password draws from — lowercase, uppercase, digits, and symbols are each worth a set of possible characters. Entropy in bits equals the password length times log2 of that pool size. Crack time assumes a determined attacker with fast offline hardware trying about 10 billion guesses per second against a stolen password database. Important: this measures length and variety only. A long password made of a dictionary word or personal detail can still be weak in practice — uniqueness matters as much as entropy, so use a password manager.
Frequently asked questions
Is it safe to type my password here?
Yes. This tool is a small script that runs locally in your browser tab. The password is never transmitted over the network, never logged, and disappears when you close or refresh the page. You can even disconnect from the internet and it will still work.
What does “entropy” mean for a password?
Entropy measures unpredictability in bits. Each bit doubles the search space: a 40-bit password has about a trillion possibilities, while 80-bit exceeds the number of seconds since the Big Bang many times over. Longer passwords with more character variety score higher.
What makes a password actually strong?
Length first (16+ characters), then randomness. Four random words (“rivers-copper-plum-haze”) beat a short soup of symbols. Just as important: never reuse passwords across sites, because attackers test leaked ones everywhere first.
My password scores well but starts with a common word. Is it safe?
Maybe not. This estimator assumes random characters; real attackers try dictionary words, names, dates, and leaked passwords first. Add true randomness — ideally generate passwords in a reputable password manager instead of inventing them.