Password strength checker
Type in a password you already have (or are thinking of using) and see honestly how strong it is — entropy calculated from length and character variety, common weak patterns flagged by name (keyboard runs, repeated characters, dates), and an estimated crack time against a realistic offline attacker. The single reason to use this over most password strength checkers online: the password is never sent anywhere, ever — check your browser's Network tab while typing to confirm it yourself.
- Nothing you type leaves this page
- Works offline once loaded
- Free forever, no signup
Preparing Password Strength Checker for you…
Loading the tool into your browser. Nothing is uploaded — the work happens on your device.
This password is never sent anywhere — checking happens entirely in your browser's JavaScript. Open your DevTools Network tab and type: nothing fires. That is the entire reason to use this page instead of a random site that promises the same thing.
{{ result.label }} — about {{ result.entropyBits }} bits of entropy.
- Length{{ result.length }}
- Character pool{{ result.poolSize }}
- Est. crack time*{{ result.crackTime }}
*Assumes an offline attacker guessing 10 billion passwords per second against a stolen, unsalted-equivalent hash — a deliberately pessimistic (attacker-favouring) estimate, not a promise.
- {{ issue }}
No obvious weak patterns detected — no keyboard runs, repeats, sequences or dates found.
How to use this tool
-
Type the password you want to test
Use the Show toggle if you need to see it while typing — nothing is transmitted either way.
-
Read the strength bar and entropy
Higher bits of entropy means an exponentially larger space an attacker has to search.
-
Fix whatever is flagged
Specific weaknesses — a keyboard run, a repeated character, a year — are named individually, not just scored.
Questions people ask
Is it actually safe to type my real password into this checker?
This one, yes — the entire check runs in your browser's JavaScript with zero network requests. Open your browser's DevTools Network tab, type a password, and confirm nothing fires; that is a stronger guarantee than any "we promise not to log it" claim, and it is exactly why this tool exists instead of trusting a random site.
How is the strength score actually calculated?
From the password's length and which character classes it uses (lowercase, uppercase, digits, symbols), which sets a baseline entropy figure — then that figure is reduced for specific weak patterns detected: dictionary-style common passwords, keyboard runs like "qwerty", repeated characters, simple sequences, and embedded years or dates.
What does the estimated crack time actually assume?
A deliberately pessimistic (attacker-favouring) scenario: an offline attacker who already has your password's hash and can attempt 10 billion guesses per second, which is roughly what dedicated cracking hardware can do against a weakly-hashed password today. It is meant to scare you appropriately, not to be a precise forecast.
My password scored "Strong" — does that mean it is safe everywhere?
It means the string itself resists guessing well. It does not protect you if you reuse that same password across multiple sites and one of them gets breached — for that, a password manager with a unique password per site (which our password generator can help create) matters more than any single password's raw strength.
Why does it flag my password even though it "looks" complex?
Complexity that follows a common pattern (Password1!, Welcome@123) is exactly what attackers' pattern-matching wordlists target first — this checker looks for those specific known-weak shapes rather than just counting character types, which is why a password that looks scrambled can still score poorly.
Related tools
- Password Generator Generate strong random passwords and memorable passphrases in your browser. Nothing is transmitt...
- Passphrase Generator Generate a strong, memorable passphrase of random words — the diceware method — entirely in your...
- Hash Generator Generate SHA-1, SHA-256, SHA-384 and SHA-512 hashes of any text in your browser using the Web Cr...
Bookmark this page — the tool keeps working offline, and your settings stay in this browser. Built by Dynamb Technologies, who make software for a living.