Password Strength Checker — Entropy & Crack Time (Private)

Password to check

Enter a password to begin

🔒 Analyzed locally with a bundled engine — your password never leaves this page.

About the Password Strength Checker

Not all passwords are equal. Summer2026! looks complex but is trivial for modern cracking tools, while four random words are easy to remember yet extremely hard to guess. This checker estimates real-world strength the way an attacker would think about it — by looking for dictionary words, names, dates, keyboard patterns, repeats and known leaked passwords, then working out how many guesses it would take to break. You get a clear meter, the entropy in bits, estimated crack times for several attack scenarios, and specific, actionable advice.

Test without worry. Everything runs on your device — the password is never uploaded, stored, or seen by anyone.

Length wins. A long passphrase of unrelated words beats a short string of mixed symbols almost every time.

Avoid the obvious. Names, birth years, qwerty-style runs and single dictionary words all drag the score down fast.

Never reuse. Even a strong password is risky if it's shared across sites — pair it with a password manager and two-factor authentication.

How it works

Three steps. No sign-up, no upload, no wait.

Type a password

Enter or paste the password you want to test — use the eye button to reveal it.

Read the meter

Watch the strength bar, entropy and estimated crack time update instantly as you type.

Act on the tips

Follow the specific warnings and suggestions to make it stronger — all on your device.

🔒

Private by design.Everything happens right here in your browser. Your files are never uploaded — we never see them.

Frequently Asked Questions

Is my password sent anywhere when I check it? ▼

No. The entire check runs inside your own browser using a bundled analysis engine. Your password is never uploaded, logged, or transmitted — nothing leaves your device, so it's safe to test even a real password.

What does the strength score actually measure? ▼

It estimates how hard the password is to guess, not just whether it has a symbol or a capital. The engine looks for dictionary words, names, dates, keyboard patterns (like qwerty), repeats and common leaked passwords, then estimates how many guesses an attacker would need. A long, unpredictable password scores far higher than a short one padded with P@ssw0rd!-style tricks.

What are entropy bits? ▼

Entropy is a measure of unpredictability in bits — each extra bit roughly doubles the number of guesses needed. As a rough guide, under ~40 bits is weak, 60+ bits is strong, and 80+ bits is very strong. It's derived here from the estimated number of guesses, so it reflects real-world guessing patterns rather than a simple character count.

Why do the crack-time estimates vary so much? ▼

Speed depends on how an attacker gets to guess. An online login that blocks rapid attempts allows only a handful of tries, while an attacker who has stolen a database and cracks it offline on fast hardware can try billions per second. The tool shows several scenarios so you can see the best and worst case for the same password.

Should I always aim for a 'Very strong' rating? ▼

For important accounts — email, banking, your password manager — yes. A great, memorable approach is a passphrase of four or more unrelated words. For throwaway logins the bar is lower, but never reuse an important password anywhere. Pair strong passwords with a manager and two-factor authentication.

Are the crack times a guarantee? ▼

No — they're informed estimates, not promises. They assume typical attacker hardware and common cracking strategies. A password that scores well here is much harder to crack in practice, but security also depends on not reusing it and on the site protecting its stored passwords properly.