Infinite Passwords
EN

Password Strength Checker

Find out exactly how crackable your password is — entropy score, crack-time estimate and character breakdown. 100% private, in your browser.

Enter a password

Character analysis

    Improve it

      Everything happens in your browser — the password you test is never sent, logged or stored. Estimates assume an attacker with 1 trillion guesses per second (offline attack) and count your actual character variety.

      What the checker measures

      Real password strength comes from entropy — the size of the space an attacker must search. We estimate it from your password’s actual length and the character classes it uses, then apply penalties for patterns humans gravitate toward: repeated characters, sequential keyboard rows and known-common passwords.

      The crack-time estimate assumes an offline attack at one trillion guesses per second — roughly what a well-equipped criminal or intelligence service can do against a leaked hash. If your password scores “Excellent” there, a website login form with rate limiting doesn’t stand a chance of being brute-forced either.

      Why “but I replaced a with @” doesn’t count

      Rule-based cracking tools try leetspeak substitutions first thing. “P@ssw0rd!” is the first billion guesses on Earth, not the last. Randomness — not clever substitutions — is what defeats automation. The checker rewards genuine variety and punishes predictable tricks accordingly.

      Laptop screen showing source code in the dark — the toolkit used to attack leaked password hashes offline
      Password cracking is just code — make sure yours isn’t in the wordlists. (Photo: Markus Spiske on Pexels)

      What to do with a weak score

      Generate a fresh random password with our random password generator, store it in a password manager, and secure your most important account first — usually your email, because it resets everything else.

      Deep dive

      How strong is my password? — what the score actually means

      Everyone asks “how strong is my password?” and almost nobody gets a straight answer. A password strength checker takes the guesswork out of it. Our free password strength test runs entirely in your browser: paste a password, and the tool estimates its entropy in bits, applies penalties for human patterns — dictionary words, keyboard walks, repeated characters, predictable substitutions — and translates the result into a crack-time estimate at a trillion guesses per second. Nothing you paste ever leaves your device, because checking a password on someone else’s server defeats the entire point.

      Password strength checker vs. password strength tester — is there a difference?

      No meaningful one. People search for “password strength checker”, “how secure is my password”, “password strength tester” and “password strength meter” for the exact same outcome: a verdict on whether their current password would survive a leaked-hash attack. This page covers all of it — entropy, character analysis, crack time and a fix-it path. Every password analyzer on this site uses the same local engine, so your results are identical whichever phrase brought you here, and nothing is transmitted, logged or stored.

      Why your password scores lower than you expect

      Rule-based crackers work through mangling lists first: capitalized dictionary words, leetspeak swaps, trailing digits, keyboard strolls. “Summer2026!” looks strong to a human and scores terribly, because every one of those moves is the first thing automation tries. The checker penalizes exactly those moves — which is why honest random passwords routinely out-score clever human ones by a factor of thousands. If your score disappoints you, believe it: complexity you can explain is complexity attackers can predict.

      The fix is always the same. Generate a fresh, random password with our random password generator (or a memorable passphrase if you must type it by hand), store it in a password manager, and start with the account that resets everything else — your email. Then enable two-factor authentication everywhere it is offered. Re-test any critical password here every so often, especially after a breach you hear about in the news.

      Reality check — how fast do passwords actually fall?

      Orders of magnitude matter more than precise estimates. A leaked 8-character all-lowercase password falls in days to minutes against fast hashing; a random 10-character mixed password might hold out for decades to centuries; a random 16-character mixed password does not fall in any meaningful sense at all. Common patterns — even exotic-looking ones like Qwerty123! — fall instantly, regardless of what entropy calculators suggest, because rule-based crackers try manglings of dictionary words before anything else. The checker’s penalties reflect exactly this gap between what looks strong and what is strong.

      Which is why the only password worth deploying is one you never co-authored. Use this page as a gate before saving passwords in your manager: if a candidate scores “Strong” or better, store it everywhere it is needed; if not, regenerate with the random password generator, or upgrade length at 20 characters for the crown jewels. Ten seconds here saves the forensic nightmare version of the same story.

      Three myths about password strength, dismantled

      Myth one: symbols make a password strong. They help, but length and randomness dominate — a 16-character all-lowercase random string (~75 bits) beats an 8-character symbol-mash (~52 bits) every time. Myth two: changing your password yearly keeps you safe. Rotation without a breach just trains people toward predictable increments (Spring2026 → Summer2026); rotate on suspicion, not on the calendar. Myth three: browser-saved passwords are the same as manager-stored ones. They are close, but a dedicated manager adds cross-browser sync, reuse reports and breach alerts that plain browser storage lacks — pick either, never a sticky note.

      What to aim for

      Treat 80+ bits as the floor for anything that matters and 100+ bits as the goal — a 16-character mixed random password delivers ~95 bits on its own. If a password scores “Excellent” under a trillion-guesses-per-second assumption, no online service is going to brute-force it, and leaked-hash attacks become economically pointless for attackers. Anything below “Strong” deserves an immediate rotation: run it through the strong password generator, not another clever tweak.

      Frequently asked questions

      Real strength is measured in bits of entropy — the log2 of how many possible passwords share your visible pattern. Length, character variety and avoiding known-common strings all count.
      Yes — the analysis runs entirely in your browser. Nothing you type is transmitted, stored or logged anywhere. You can verify by watching the network tab.
      Under 40 bits is weak, 60+ is strong, 80+ is very strong, 100+ is excellent. For reference, a random 16-character mixed password is ~95 bits.
      Because it appears in every breach dictionary on Earth. Strength scoring recognizes known-common passwords and obvious sequences — they are the first things attackers try.
      No — length matters most. A 16-character lowercase-only password (75 bits) beats an 8-character all-symbols one (~52 bits). Symbols help, but size wins.
      The right password is one that is random, unique to a single account, and long enough to resist brute force — full stop. It is not about looking complex; it is about being unpredictable to both humans and machines. If you can recall your own password by meaning, it is the wrong one.
      A powerful password maximizes entropy: length first, then true randomness, then character-class diversity — and it must be unique per account. A 16-character random mixed string (~95 bits) is powerful; an 8-character one with clever symbols is not. Uniqueness is the multiplier that makes raw strength matter.
      A password generator is a tool that creates random, hard-to-guess passwords using a cryptographically secure source of randomness. This tool creates them locally in your browser with the Web Crypto API (crypto.getRandomValues) — free, instant, and nothing ever leaves your device or is stored.
      Three steps: 1) Open this site or any browser-based generator built on the Web Crypto API. 2) Set the length to at least 16 characters and enable upper, lower, numbers and symbols (exclude ambiguous characters only if you must type it by hand). 3) Click generate and copy the result into a password manager — never reuse it.
      Yes — provided they are built on a cryptographically secure random number generator. This tool uses the browser’s Web Crypto API (crypto.getRandomValues), the same source used for TLS keys. That output is indistinguishable from true randomness, so guessing attacks perform no better than pure chance against it.
      Anything short (under 12 characters), human-invented, reused across sites, derived from a leaked corpus (123456, qwerty, password), or padded with predictable patterns — a capital first letter plus a trailing exclamation mark does nothing against modern rule-based crackers.
      A unique password is one used nowhere else — never before, never again, never a variant with a swapped symbol. Reuse is the single highest-impact failure mode in real-world breaches: one leak opens every account sharing the password. Generate a fresh one per account and let a password manager remember them.
      The best password generator is free, client-side, cryptographically random and never stores what it makes. Every serious option meets that bar — and this site is one of them: no signup, no limits, Web Crypto API, zero network calls. The worst “free” generators are ones that phone your new password home.
      There is no single perfect password — but a practically perfect one is long (16+ characters), fully random, unique to one account, stored in a password manager, and backed by two-factor authentication. Anything short, human-invented or reused fails at least one of those.
      “123456”, without contest — it tops NordPass’s annual lists and multi-year breach datasets. It is so dominant that security guides open with it. If you have ever used it anywhere, rotate those accounts today.