Check how strong your password is
The analysis runs in your browser: neither the password nor its hash leaves the device. We look for dictionary words, dates, keyboard runs and typical templates.
Waiting for input
Type a password — we will show its strong and weak points.
Cheat sheet
How long a password survives
Full brute force of a random password built from both letter cases, digits and symbols (94 characters) on a rig doing 10¹⁰ hashes per second.
| Length | Entropy | Full brute force |
|---|---|---|
| 6 | 39 bits | under a minute |
| 8 | 52 bits | about 3 hours |
| 10 | 66 bits | about 8 years |
| 12 | 79 bits | 77 thousand years |
| 16 | 105 bits | 6·10¹¹ years |
| 20 | 131 bits | longer than the age of the universe |
This is an upper bound. Real attacks almost never brute-force: they start with leaked passwords, dictionaries and substitution rules — which is why “Password123!” falls in seconds despite its 12 characters and every character class.
Anti-examples
What a cracker breaks in seconds
| Password | Why it is bad |
|---|---|
| Qwerty123! | keyboard run plus the “word-digits-symbol” template |
| Smith1985 | surname and birth year sit in leaked databases |
| P@ssw0rd | the @ and 0 substitutions are standard attack rules |
| London2026 | dictionary word plus the current year |
| aaaaaaaa12 | repeats add no uncertainty |
| river-fog-owl | a phrase invented by a human, not drawn by lot |
What our analysis does. It measures the alphabet and the length, folds leet substitutions back to letters (0→o, @→a), searches the resulting stem against a 4096-entry word list and greedily covers the password with matches. The more it covers, the cheaper the password is for a dictionary attack.
Then it subtracts points for an embedded year, keyboard runs, triple repeats and the “word + digits + symbol” shape. The result is converted into bits and into cracking time.
The estimate is deliberately pessimistic: better to scold a good password than to praise a weak one. If you want one that is strong by construction, take a generated one.
Questions
Frequently asked questions
Do you really not send the password anywhere?
Correct. The whole check is JavaScript in your tab. The only network request the page makes is the word list, and it is identical no matter what you type. You can disconnect from the internet after the page loads and keep checking.
Why is my complex password scored so low?
Most likely it has a dictionary stem, a date or a keyboard run in it. Crackers do not start with random combinations; they start with word lists and substitution rules, so “p@ssw0rd” is nearly the same as “password” to them.
How do I check whether my password was breached?
There is a separate page for that — the breach check. It is deliberately kept apart: it is the only tool on the site that contacts an external service. It uses k-anonymity, so only the first five characters of the SHA-1 are sent and the password itself stays in your browser.
Next