Wondering how secure is my password? This password strength checker scores whatever you type in seconds and shows the estimated time to crack it, so you can see whether your login would survive a guessing attack before a real attacker tries one. Pair the score with the habits below and you will know exactly which change makes your password stronger.
Password Strength Checker: What the Score Actually Measures
A password's strength is not about how complicated it looks. It is about how many guesses an attacker needs before landing on it. A password strength test turns that idea into a number: it looks at the length, the mix of characters and the patterns inside your password, then estimates how long an automated program would need to crack your password.
The result is a score from very weak to very strong, plus a time-based estimate. Treat both as a guide rather than a guarantee: any password strength tool is blind to how a particular website stores your credentials or whether the password has already leaked elsewhere, and that remaining risk is why the later sections cover habits too.
How a Password Strength Tester Reads Your Password
A password strength tester works through four checks in order. First it counts the characters and notes which character sets you used. Next it compares the string against lists of common passwords and dictionary words. Then it looks for keyboard patterns such as "qwerty" and sequential characters such as "abcd" or "4321". Finally it combines everything into a guess count, and that count becomes your score and your time to crack.
Why Password Security Matters for Every Account
Good password security protects far more than one login. Your email decides who can reset every other account you own, and a single weak password there puts a bank account, your cloud storage and your social media within reach. Strong credentials are the cheapest layer of online security and digital security you can add, and a leaked password also puts your privacy and the risk of malware-laden phishing messages in play. The score tells you whether the password guarding your email would survive a guessing attack, which is the question that decides how exposed everything else is.
How to Use This Password Strength Meter
Using the password strength meter takes under a minute, and it is built so you never need to type a live password you are nervous about. Test a similar password with the same length and structure if you prefer.
- Type or paste a password into the box. The score updates with every keystroke.
- Read the strength label, from very weak to very strong, and the estimated time to crack.
- Run a quick password test, then check the character mix: lowercase, uppercase, numbers and symbols.
- Lengthen the password or add unrelated words, then watch the estimate jump.
- Once you have a result you trust, save it in your password manager rather than memorising it.
This password meter and the same password checker flags warnings such as a common word, a repeated character or a date, which are exactly the weaknesses a dictionary attack goes after first.
Password Strength Calculator: The Entropy Formula
Under the hood, a password strength calculator measures entropy, the number of bits of uncertainty in a password. For a password built from random characters, the formula is:
$$\text{Entropy (bits)} = L \times \log_2(N)$$
Here \(L\) is the password length and \(N\) is the size of the character pool: 26 for lowercase only, 52 for both cases, 62 once numbers are added, and 94 with every printable symbol. Every extra bit doubles the guesses needed. To get the time to crack, divide the total number of combinations by two (an attacker finds it halfway through on average), then divide by the guess rate:
$$\text{Time to crack} = \frac{2^{\text{bits}}}{2 \times \text{guesses per second}}$$
The examples on this page assume an offline attacker making 10 billion guesses per second, a realistic figure for a fast graphics-card rig attacking a stolen, weakly hashed file. Websites that limit login attempts are far slower to attack, which is why the offline case is the cautious one to plan for.
How the Strength Ratings Are Banded
This tool maps entropy onto five bands, so a score is easy to act on:
| Entropy | Rating | What it means |
|---|---|---|
| Under 28 bits | Very weak | Falls in seconds, even to a simple guess |
| 28 to 44 bits | Weak | Falls in hours to months offline |
| 45 to 59 bits | Fair | Survives casual guessing, not a determined attack |
| 60 to 79 bits | Strong | Takes years to centuries to crack |
| 80 bits and above | Very strong | Beyond practical brute force today |
Worked Example: Testing a 12-Character Random Password
Take the password tR7#vQ2!mK9p. It has 12 characters drawn from uppercase and lowercase letters, numbers and symbols, so the pool is 94 and the entropy works out to:
$$12 \times \log_2(94) = 12 \times 6.555 \approx 78.7 \text{ bits}$$
At 10 billion guesses per second, that is about 7,540 centuries, roughly 754,000 years. It lands in the strong band, just 1.3 bits short of very strong. Compare it with the other passwords tested for this page:
| Password pattern | Pool size | Entropy | Estimated time to crack |
|---|---|---|---|
| 8 lowercase letters | 26 | 37.6 bits | 10.4 seconds |
| 10 letters and numbers | 62 | 59.5 bits | 1.3 years |
| 4 random dictionary words | 7,776 words | 51.7 bits | 2.1 days |
| 6 random dictionary words | 7,776 words | 77.5 bits | 3,502 centuries |
| 12 random characters | 94 | 78.7 bits | 7,540 centuries |
| 16 random characters | 94 | 104.9 bits | Far beyond centuries |
The pattern is easy to spot: every added character is worth more than another symbol, and the gap between the first and last rows is the difference between seconds and many lifetimes.
Running a Password Strength Test on a Reused Client Portal Login
Ines, a freelance bookkeeper, has just learned that a supplier she once used was breached, and her client portal password has been the same for six years: Rover2019!. Before replacing it, she runs a password strength test to see how bad it really is.
The raw character math looks flattering. Ten characters from a 94-symbol pool give 65.5 bits, about 85 years at 10 billion guesses per second. But the checker's pattern review tells a different story: "Rover" is a pet name from the first few thousand entries of any name list, "2019" is one of roughly a hundred plausible years, and the trailing "!" is the most common symbol of all. Counting only those choices, the search space shrinks to around 23 bits, and the estimate drops to under a millisecond. The rating reads very weak, far below the 28-bit floor.
She builds a replacement from five words drawn at random from a 7,776-word list, giving 5 × log2(7,776) = 64.6 bits. The estimate climbs to about 45 years offline, which sits in the strong band (60 to 79 bits) and clears the 16-character length that her insurer's cyber policy asks for, since the passphrase runs to 27 characters.
The result settles three decisions at once. She saves the passphrase in her password manager rather than memorising it, retires the old password on the portal and the two other sites that shared it, and switches on two-factor sign-in so a future leak of this one string cannot open the account on its own. Then she re-runs the checker on the final passphrase to confirm the score did not change after she added a hyphen between words.
What Makes a Strong Password?
A strong password is long, random and used in exactly one place. Security guidance converges on the same advice: use at least 12 characters, aim for 16 or more on accounts that matter, and never build it from personal information. Many sites publish password requirements, but meeting a minimum is not the same as being strong.
Password Length Beats Complexity
Because each character multiplies the search space, password length does more work than any single trick. Ten lowercase letters hold more entropy than eight characters of mixed symbols would suggest, and the time to break grows exponentially with every character you add. Special characters help only a little; if a site allows it, go past 14 characters for anything that guards money or email.
Choose a Passphrase You Can Remember
A passphrase strings together random, unrelated words, for example "harbor lantern bicycle ocean quartz mild". It is easier to remember than a jumble of symbols and, at six words, nearly matches a 12-character random password for entropy: paste a six-word passphrase into the checker and it reads about 77.5 bits, strong. The words must be chosen randomly; a famous quote or a song lyric is not random and is in every cracking list.
Combinations That Look Clever but Are Not
Replacing an "a" with "@" or an "e" with "3" is a substitution every cracking program already tries. The same goes for adding "123" or a year at the end. A weak password dressed up with numbers and symbols is still weak. The meter's warnings highlight these patterns so you can replace them with real randomness: a combination of letters, numbers and symbols placed without a pattern.
Is It Safe to Use a Password Tester Online?
It is a fair question, and the answer depends on how the page is built. A safe password strength testing tool runs its checks in your browser, so the characters you type never leave your browser and are not stored on a server. This tool follows that approach: everything is processed locally, and you can disconnect from the internet and watch it keep scoring.
Even so, never type a live password into a site you do not trust. If you want extra certainty, test a lookalike with the same length, character mix and structure rather than the real thing.
Where Estimators Like zxcvbn Fit In
Some checkers rely on zxcvbn, an open-source estimator that recognises names, dictionary words, dates and keyboard walks rather than simply counting characters. Entropy math is a ceiling and a pattern-aware estimator is a reality check. A password can show high raw entropy yet score low because it contains a common word, and the lower number is the one to believe.
How Attackers Crack Passwords: Brute Force, Dictionary Attacks and Data Breaches
Hackers rarely guess one password at a time by hand. A brute force program tries every combination, while a dictionary attack tries words, names and leaked common passwords first because they succeed most often. Supercomputers and graphics cards manage billions of attempts per second against stolen files, and the time-to-crack estimate above models exactly these attacks.
The bigger danger is reuse. People who reuse passwords are the usual victims: when a site suffers a data breach, attackers take the exposed credentials and try them on other sites. Breach lookups such as haveibeenpwned show whether a password has already appeared in data breaches, and any password that has been compromised should be retired at once, however strong the score looked. Breach exposure is the one thing the score cannot see, and the fallout includes identity theft, fraud and real financial losses, and stolen credentials let a hacker impersonate you on your email, shopping and banking sites.
Password Tips and Best Practices for Safer Accounts
Strong habits matter as much as one strong string. These password tips cover the choices that make the biggest difference:
- Use a unique password for every account, so one leak stays contained.
- Avoid your name, birthday, pets and any personally identifiable information, plus anything else a stranger could find on social media.
- Let a password manager generate, store and fill your logins in an encrypted vault.
- Create new ones with a password generator set to at least 16 characters.
- Switch on two-factor sign-in and use passkeys wherever a site offers them.
- Entropy
- A measure of unpredictability in bits; each extra bit doubles the guesses an attacker needs.
- Passkey
- A login method that replaces the password with a cryptographic key stored on your device.
Check your password habits twice a year: retire anything short, reused or older than a leak you have heard about. Re-run your important passwords through the checker twice a year and retire anything it rates weak, short or reused: across your online accounts, that is the simplest cybersecurity routine most people will ever need.