Password Strength Checker
Honest entropy and crack-time estimates.
Password Strength Checker estimates how long a password would survive an offline attack, based on its length, character variety and how much of it matches common patterns — dictionary words, keyboard runs, dates, repeats and leetspeak substitutions. It runs locally and warns you not to type a real password.
Loading Password Strength Checker…
Runs entirely on your device. No file or text you enter here is uploaded. How to verify it.
How to use Password Strength Checker
- Type a candidate password.
- Read the entropy estimate and the patterns it detected.
- Follow the specific weaknesses it names.
Questions about Password Strength Checker
Should I type my actual password here?
No, and no page should tell you otherwise. Test a password with the same shape instead. Nothing is transmitted from this page, but building the habit of typing real passwords into web forms is what gets people phished elsewhere.
Why is "P@ssw0rd1!" weak despite having every character class?
Because attackers apply the same substitution rules you did. Cracking tools try dictionary words with leet substitutions and trailing digits first. Length and unpredictability beat character-class checkboxes every time.
How reliable are the crack-time numbers?
They are order-of-magnitude estimates for an offline attack against a fast hash. Against a properly salted slow hash the real time is far longer; against a service that leaked plaintext it is instant. Treat the number as a comparison, not a promise.
Does it tell me whether my password has been in a breach?
No. Checking a breach corpus means sending part of a hash to somebody's server, and this page never makes a network request at all. Use a dedicated breach service for that, and treat any password you have reused across sites as already exposed.
Is this better than the strength meter on a signup form?
It is more honest about why. Most signup meters count character classes, so "P@ssw0rd1!" sails through; this one names the dictionary word, the leet substitution and the trailing digit-and-symbol shape, then subtracts entropy for each. Neither can know whether the password is already in a leak.
Is Password Strength Checker really free, with no limits?
Yes. There is no account, no daily cap, no file-size tier and no watermark, because there is no server cost to recover. The site is funded by clearly disclosed partner recommendations on the Partners page, never by metering the tools.
Are my files or text uploaded when I use Password Strength Checker?
No. Everything is processed by JavaScript running in your browser, on your device. You can verify it: open your browser's developer tools, switch to the Network tab, and use the tool. You will see no request carrying your data — because there is nowhere for it to go.