Password Strength Checker
Find out how secure your password is — a 0–4 strength score, an entropy estimate, and realistic crack-time figures for online, bcrypt and GPU attacks — plus the exact weaknesses to fix. It checks for common and breached passwords, dictionary words, l33t swaps, keyboard walks and sequences. Everything runs in your browser; nothing is uploaded.
This never leaves your browser — nothing is typed, logged, or sent anywhere.
All analysis runs locally in JavaScript, with no network calls and no analytics on this value. Still, as a habit, don't paste a password you actually use into any website — including this one. Try a look-alike instead.
100% client-side. Nothing you type is stored or transmitted — close the tab and it is gone.
What this tool is
- A free, in-browser password strength checker: type or paste a password and see a 0–4 strength score, an entropy estimate in bits, and how long it would take to crack.
- Everything runs locally in JavaScript — nothing you type is logged, stored or sent to any server, and there is no analytics on the value. (As a habit, still never paste a password you actually use into any website.)
- It is honest about being an estimate: it starts from the character pool × length, then reduces the score for guessable patterns — common/breached passwords, dictionary words (including l33t swaps like "P@ssw0rd"), keyboard walks, number runs, repeats and years.
- Crack-time estimates are shown at three realistic attacker speeds: a throttled online login (~100/s), a stolen bcrypt/argon2 database (~10k/s), and a fast GPU rig against MD5/SHA-1/NTLM (~100 billion/s).
- The real fixes it points you to: length over complexity, a password manager generating a unique random password per site, and passkeys or 2FA — because reuse and breach exposure matter more than composition.
What makes a password strong?
A strong password is simply one that is hard to guess. Security people measure that in entropy — a count, in bits, of how many equally-likely possibilities a password could have been. Each extra bit doubles the number of guesses an attacker must make, so entropy is the honest yardstick, not whether a password "looks complicated". A password with 70+ bits of real entropy is strong; one with 30 bits is not, no matter how many symbols it contains.
The most reliable way to buy entropy is length. Adding one character multiplies the search space by the size of the character set; adding one symbol to a short, predictable password barely moves it. This is why a passphrase of four or five random, unrelated words — correct horse battery staple — beats a tortured ten-character string, while being far easier to remember.
Why "P@ssw0rd" is weak
P@ssw0rd hits every "complexity rule" — upper, lower, digit, symbol — yet it is one of the most-guessed passwords on earth. Attackers do not brute-force character by character; they start from leaked password lists and dictionaries, then apply rules: capitalise the first letter, swap a→@ and o→0, append a year. Those transformations are predictable and free, so a dictionary word dressed up in leetspeak has almost the entropy of the bare word. This tool reverses those same substitutions, which is why it flags P@ssw0rd as weak.
What actually matters more than composition
- Reuse. A unique, even mediocre, password per site limits a breach to one account. A brilliant password reused everywhere falls everywhere the moment one site is breached — credential-stuffing attacks replay leaked pairs across thousands of sites automatically.
- Breach exposure. If a password already appears in a public breach corpus, its strength is irrelevant — it is on a list an attacker tries first. Check addresses against Have I Been Pwned and rotate anything exposed.
- A password manager. Let it generate a long random password for every account. You then only have to remember one strong master password (or unlock with biometrics), and length and uniqueness are solved at once.
- Passkeys & 2FA. A passkey replaces the password with a phishing-resistant key pair; where passkeys are not yet offered, a second factor (an authenticator app or hardware key, not SMS where avoidable) stops a stolen password from being enough on its own.
Honesty note: this score is a heuristic estimate, not a guarantee. It approximates how a smart attacker would guess — it cannot know whether your exact password already sits in a breach dump, and it does not send your password anywhere to check. Use it to learn which patterns to avoid, then rely on a password manager, passkeys and 2FA for the real defence.
Frequently asked questions
What makes a password strong?
Strength comes mostly from unpredictability (entropy), and the cheapest way to buy entropy is length. A long password drawn from a large character set — or a passphrase of 4–5 random, unrelated words — is far harder to guess than a short password peppered with symbols. What actually makes a password weak is predictability: if it is a known/breached password, a dictionary word (even with "l33t" swaps like a zero for an o), a keyboard walk such as qwerty, a number run such as 12345, a repeated chunk, or a year/date, an attacker tries those patterns first and brute force never enters the picture. "P@ssw0rd" looks complex but is one of the most-guessed passwords in existence. The single most important rule, though, is not reusing passwords across sites — a breach of one site then compromises all of them regardless of how strong the password is.
Is this password strength checker safe to use?
Yes. The checker is 100% client-side: all analysis happens in your browser with JavaScript, there are no network requests, nothing is stored, and there is no analytics or logging on the password you enter. Close the tab and the value is gone. Because PlayCISO is a security company, we hold ourselves to the obvious standard here — but the right habit with any "password checker" website is to assume the worst, so we still recommend you do not paste a password you genuinely use into any site, including this one. Test a structurally similar look-alike instead, or use it to learn what patterns to avoid.
How long should a password be?
Aim for at least 12 characters for everyday accounts and 16 or more for anything important (email, banking, your password manager’s master password). Length matters more than squeezing in symbols: each extra character multiplies the search space, so a 16-character passphrase of random words typically beats a tortured 10-character "Xk7$!" string while being far easier to remember. The practical answer for most people is to let a password manager generate a long random password (20+ characters) for every site, so length and uniqueness are both handled automatically, and to enable a passkey or 2FA wherever it is offered.
How accurate are the crack-time estimates?
They are deliberately presented as order-of-magnitude estimates, not guarantees. The tool converts its entropy estimate into the number of guesses an attacker would need (about half the keyspace on average) and divides by an assumed guess rate. Real speed depends heavily on how the password is stored: a modern slow hash like bcrypt or argon2 might allow only thousands of guesses per second, while an unsalted fast hash like MD5, SHA-1 or NTLM can be attacked at tens or hundreds of billions per second on a GPU rig — which is exactly why the tool shows several scenarios rather than one number. Treat a result of "centuries" as "comfortably strong" and anything measured in seconds, minutes or days as "change it".