Free Password Strength Checker

Worked example

Click the "Password" box and type 9fK2!xQ. It shows as dots; press "Show" to read it. The page reports Strength "Good", Entropy "46 bits", "Fast hash (10B guesses/s)" "2 hours" and "Slow hash, bcrypt-style (10K/s)" "206 years". Because the password has only 7 characters, "What to fix" says "Short: 7 characters. Length matters most." and the "Password requirements" list marks "At least 8 characters" and "At least 12 characters" with a hollow circle while the other rows pass. Press "Make me a strong passphrase" to get six random words, such as proud-gate-merry-wise-brave-fancy, labelled "Random passphrase, about 53 bits". Now replace the text with Summer2024. Strength falls to "Very Weak", Entropy to "0 bits", both times read "instantly", and "What to fix" says "It is on lists of the most common passwords." and "Contains a year (2024), which attackers try first."

Which settings to use, and the limits

• Read the score as an estimate. "Very Weak", "Weak", "Good" and "Strong" come from an entropy estimate plus the number of requirements met. Under 28 bits the score cannot rise above "Very Weak", under 40 above "Weak", and under 60 above "Good". A match on the built-in common-password list forces "Very Weak", and a password built on a common word or name is held at "Weak". The amber note "Heuristic only." warns that the score rests on structure and short built-in lists, so a weak password that is on neither list can still score well.
• Compare the two crack times. Both figures divide the number of guesses by a guess rate. "Fast hash (10B guesses/s)" assumes 10 billion guesses a second, as against a quickly computed hash. "Slow hash, bcrypt-style (10K/s)" assumes 10,000 a second. The note under the cards says the estimates assume an attacker who stole the hashed password and guesses offline, and that sites that rate-limit logins are much harder to attack. Times read "instantly" below one second, then seconds up to years, then for example 12K years, "millions of years" and, past a billion years, "effectively uncrackable".
• Use the optional breach check. Press "Check against known breaches" to look the password up in the Have I Been Pwned data. The browser makes a SHA-1 hash of the password, sends only its first 5 characters to api.pwnedpasswords.com and compares the rest on your device, so the password itself is never sent. The answer is "Found in 12,345 known breaches" with advice not to use it, or "Not found in any known breaches." Tick "Check automatically after I stop typing" to run it 0.9 seconds after you pause, from 4 characters on; the choice is remembered in this browser. Editing the password clears the old result.
• Use the passphrase button when the score is not Strong. "Make me a strong passphrase" appears under "What to fix" while something is typed and the score is "Very Weak", "Weak" or "Good". It joins six words with hyphens, picked with the browser's secure random generator from a list of about 490 short English words, and labels it "Random passphrase, about 53 bits". "Copy" copies it and "Test it here" puts it in the box and shows it. The checker then scores it as ordinary characters, so its Entropy figure is far higher than 53 bits. Trust the 53-bit label, which counts only the random word choice.
• Know what the requirements list checks. The list shows "At least 8 characters", "At least 12 characters", lowercase and uppercase letters (or "Contains letters (any alphabet)" for scripts without case, such as Arabic, Hebrew or Chinese), "Contains numbers", "Contains special characters", "Not a common password", "No repeated characters (3+ times)" and "No common patterns (123, abc, qwerty, years)". The common-password test ignores case, accents, digits and symbols at either end, and swaps such as @ for a and 0 for o, so P@ssw0rd!! is caught. "What to fix" shows at most two findings.
• Use Show to check what you typed. The box hides the password as dots and switches off spell-check and automatic capitals. Press "Show" to read it and "Hide" to cover it again. The password lives only in the open page; the one thing saved in the browser is the setting for the automatic breach check. Passwords in other alphabets are scored by script: Cyrillic, Greek, Arabic, Hebrew, Armenian, Georgian, Indic, Thai, Japanese kana, Korean and Chinese letters each add a pool of possible characters, and are not treated as symbols.

Common problems and how to fix them

It says "Breach check failed — check your connection and try again."

The breach lookup is the only part of the page that uses the network. It asks api.pwnedpasswords.com for the list of hash endings that share your 5-character prefix, and this message appears when that request fails or the service answers with an error. Check that you are online and that nothing blocks that address, then press "Check against known breaches" again. The strength score does not use the network, so it keeps working.

Strength says "Very Weak" and Entropy says "0 bits" for a password that looks complicated.

The password matched the common-password list, which sets the entropy to 0, both crack times to "instantly" and the score to "Very Weak". The match ignores case, accents, digits and symbols at either end, look-alike swaps such as 4 for a, 3 for e and 0 for o, and a leading "my" or "the". So Password123!, P@ssw0rd!! and mypassword all count as the same famous password. Choose something unrelated to a word.

It says "Built on the common word “istanbul”." (with your own word).

After the digits and symbols at either end are removed and look-alike swaps undone, the password is a name, month, city or everyday word from the built-in list. The score is then held at "Weak" at most, and the entropy is limited to the word's own cost plus a few bits for decoration: 3.4 bits per digit, 5 per symbol, 1 for a capital letter. A year at the end counts for about 7 bits in all. Add unrelated words, or use the passphrase button.

It says "Keyboard or alphabet run “qwerty123”." (with your own run).

Three or more neighbouring characters from a keyboard row, a diagonal such as qazwsx, the number row, the alphabet or the digits 0 to 9, forwards or backwards, count as a run. The same rows on AZERTY and Russian keyboards count too. Characters inside a run count at a quarter of their normal strength, and the row "No common patterns (123, abc, qwerty, years)" fails. Break the run up with unrelated characters.

The "Make me a strong passphrase" button is missing.

It sits inside the "What to fix" panel, which is shown only while the box is not empty and the strength is "Very Weak", "Weak" or "Good". When the score is "Strong" the panel is hidden, and with an empty box only the input shows. To get a passphrase from an empty box, type any short text first, then press the button.

How it compares

This page gives an estimate, not a verdict. It uses short built-in lists of common passwords, names and words, a keyboard-pattern test and a character-pool entropy model, and it knows nothing about your name, your birthday or the site you are choosing a password for. The optional breach check uses the public Have I Been Pwned range service and tells you only whether this exact password appears in leaked data, not whether a similar one does. For random character passwords the page links to the password generator ("Generate a strong password"), and it makes passphrases itself. It does not store passwords or check how a site hashes them, so the two crack times are assumptions about attacker speed.