Analyse your password strength with entropy score, GPU crack time estimate, and detailed improvement checklist. Nothing is stored or sent anywhere.
type a password to analyse
Password to check
Your password is not stored or transmitted anywhere.
How to Use the Password Strength Checker
Type your password — enter any password to analyse its strength in real time. The analysis updates with each keystroke.
Read the strength score — see Weak, Fair, Strong, or Very Strong rating based on length, complexity, and common password patterns.
Review specific feedback — the checker explains exactly why the password scored as it did: too short, missing character types, common word detected, etc.
Check time to crack — see the estimated time an attacker would need to crack this password with modern hardware.
Improve your password — follow the specific suggestions to strengthen the password until it reaches Strong or Very Strong.
🔒 Privacy note: Your password never leaves your browser. All analysis is performed locally in JavaScript. Nothing is sent to any server. You can safely test real passwords — they are not stored, logged, or transmitted anywhere.
Understanding Password Strength
📏 Length is Primary
Password strength increases exponentially with length. Each additional character multiplies the number of possible combinations by the character set size. An 8-character password using all character types: 95^8 = 6.6 trillion combinations. A 16-character password: 95^16 = 4.4 × 10^31 combinations — 6.6 billion times stronger. Length is the single most impactful factor.
🔢 Character Set Size
Lowercase only (26 chars): weakest. Lowercase + uppercase (52): moderate. + digits (62): good. + symbols (95): strong. Each additional character type multiplies possible combinations. A 12-character lowercase-only password (26^12 = 95 trillion) is weaker than an 8-character mixed-type password (95^8 = 6.6 trillion is actually comparable — length matters more than character variety for long passwords).
📚 Dictionary Attacks
Most cracking attempts start with dictionary attacks — trying common words, names, dates, and known passwords before trying random combinations. 'Password1!' fails despite having all character types because it is in every attacker's dictionary. Genuine randomness is essential — human-chosen 'random' passwords follow predictable patterns that attackers exploit.
⚡ Cracking Speed Reality
Modern GPU-based password crackers attempt 100 billion+ hashes per second. An 8-character all-lowercase password (208 billion combinations) would be cracked in 2 seconds. A 12-character mixed password: years. A 16-character random password: longer than the universe's age. The threshold for 'secure against offline attack' is approximately 12 random mixed-case characters.
🔍 Pattern Recognition
Password strength checkers identify common weak patterns: dictionary words (even with substitutions like @ for a). Keyboard patterns (qwerty, 123456, asdfgh). Dates (1990, 2026). Names. Repeated characters (aaaaaa). Sequences (abcdef). Leetspeak substitutions (p@ssw0rd). These patterns are all in attacker dictionaries despite feeling 'creative' to users.
🎲 Entropy Measurement
Password entropy (measured in bits) represents unpredictability. Each bit doubles the number of possibilities. 40 bits: 1 trillion combinations, crackable in minutes. 60 bits: 1 quadrillion, crackable in hours with GPU. 80 bits: practically uncrackable with today's hardware. 128 bits: computationally secure for any foreseeable future. High-entropy passwords require genuine randomness, not human patterns.
Password Security Strategy
The password manager imperative
The only practical way to have strong, unique passwords for every service is a password manager. Humans cannot memorise dozens of strong random passwords — so they reuse them, weakening security across all accounts simultaneously. Password managers (Bitwarden, 1Password, KeePass) generate and store unique strong passwords for every site, requiring only one master password to be remembered. The security improvement from adopting a password manager is larger than any other single security action most people can take.
Passphrase strength
A passphrase of 4+ truly random words (correct-horse-battery-staple) provides approximately 44 bits of entropy per word from a large wordlist, totalling 176 bits — far exceeding minimum security requirements while being far more memorable than a random character string. The key is true randomness (using dice or a random word generator) rather than meaningful phrases ('my dog is fluffy' is weak — predictable word combinations are in attacker dictionaries). Passphrases are recommended by NIST for passwords humans must remember.
Two-factor authentication priority
A strong unique password + two-factor authentication (2FA) provides near-absolute protection against account compromise through password attacks. Even if your password is somehow obtained, the attacker cannot access the account without the second factor. Enable 2FA on all critical accounts: email (most critical — controls password resets for everything else), banking, password manager, work accounts. Use an authenticator app (Google Authenticator, Authy, Microsoft Authenticator) rather than SMS — SIM swapping attacks compromise SMS-based 2FA.
🔐 Password strength hierarchy (from weakest to strongest): Common word (password) → Word + numbers (password123) → Word + substitutions (p@ssw0rd) → Random characters, short (Kj8#mQ) → Random characters, long (Kj8#mQpL2$nVxR7!) → Random passphrase (correct-horse-battery-staple) → Random passphrase + 2FA (effectively unbreakable). The jump from any single factor to passphrase + 2FA is enormous.
Frequently Asked Questions
What makes a strong password?
A strong password is at least 12 characters, uses uppercase and lowercase letters, numbers, and special characters, avoids dictionary words and personal information, and is unique (not reused). A passphrase (4+ random words) is often stronger and more memorable than a complex short password.
What is password entropy?
Entropy measures unpredictability in bits. Each bit doubles the number of possible combinations. A password with 60+ bits of entropy is considered strong. A 16-character password using all character types achieves ~100 bits of entropy — effectively uncrackable by brute force.
How fast can passwords be cracked?
A modern GPU can attempt ~10 billion passwords/second against common hash algorithms. An 8-character password with only letters: crackable in hours. 12-character mixed: years. 16-character mixed: centuries. Length matters more than complexity.