Loading Password Strength Analyser…
This runs entirely in the page. There is no request to send it in, no storage, and no record after you close the tab — but do treat any password you have typed into any website as one to change.
Enter a password
Type a password above. The estimate assumes the attacker already has the hashed database and is guessing locally, which is the case worth planning for.
A pool is the number of distinct characters an attacker has to consider, added up over the classes you used.
Breach-list passwordnot found
Adjacent keyboard keysnot found
Alphabet or digit runnot found
Repeated characternot found
Four-digit yearnot found
A score is not a promise. The number here describes how long guessing would take, and guessing is not how most passwords are lost — reuse across sites, a phishing page and malware on the machine all defeat a very strong password without attacking it. A password manager and multi-factor authentication move the needle further than any extra character can.
Most signup forms judge a password by what characters it contains. That test is easy to satisfy and tells an attacker almost nothing, because guessing software does not walk the alphabet in order — it works from lists of what people have actually chosen, then applies rules that capitalise a first letter, swap an a for an @, and stick a year on the end. A password assembled the way the form asked is exactly the shape those rules produce.
So this analyser does two things in sequence. It measures how large the search would be if the password were random, and then it subtracts for each way the password announces that it was not.
The character pool is the sum of the classes present: 26 for lower case, 26 for upper, 10 for digits and 33 for the printable ASCII punctuation, giving 95 when all four appear. Raw entropy is the length multiplied by the base-two logarithm of that pool, so twelve characters from the full set is about 79 bits before anything is taken away.
Five deductions follow. A password found on the built-in list of common choices is capped at 8 bits outright, because it is looked up rather than searched for. A run of adjacent keyboard keys costs 12 bits, an alphabetical or numeric run 10, a character repeated three times or more 8, and anything shaped like a four-digit year 6. The verdict bands sit at 28, 40, 60 and 80 bits.
The estimate quoted is for an offline attack at ten billion guesses a second, against half the search space, which is the average a random target takes to reach. That rate is a stand-in for an attacker with a stolen database and their own hardware, and it is deliberately pessimistic — the point is the order of magnitude, not the number of hours.
How fast a real attack runs depends on how the site stored the password, which this tool cannot know. An unsalted SHA-1 column falls far faster than the figure here; bcrypt at a high cost factor, or Argon2id, is slower by many orders of magnitude. A guess against a live login form is slower still, and usually stopped by rate limiting long before entropy matters.
The built-in list of common passwords holds about sixty entries. Real cracking dictionaries hold hundreds of millions, assembled from every breach of the last fifteen years, so a password this tool has never heard of may still be sitting in one. Five pattern families are checked here against the thousands of mangling rules a serious rig applies.
It also knows nothing about you. Your surname, your child’s name, your street, the team you support and the year you graduated are all high-value guesses to somebody targeting you specifically, and all of them read here as ordinary letters. Nothing typed into the box is sent anywhere, stored, or kept after the tab closes — but a password you have typed into any web page is one worth changing regardless.
The reliable fix for a weak score is to stop inventing passwords. A generated value has no story behind it for a rule set to reconstruct, and a password manager removes the only reason people invent them, which is having to remember the result.
Two accounts earn more care than the rest: the mailbox that receives every reset link, and the vault that holds everything else. Both are routes into every other account you own. Where a second factor is offered, switching it on defeats an attacker who already has the password — which is the situation no amount of entropy addresses.
Because length cannot rescue a password that is already on a list. Once the value is recognised as a common choice the score is capped at 8 bits, which is the honest reading: the attacker looks it up in the first second rather than searching for it.
Probably neither exactly. Different estimators use different dictionaries and different penalties, so they routinely differ by a band. Treat any of them as a rough gauge, and act on the specific weakness named rather than on the label attached to it.
No, and it is not close. Adding one symbol to a twelve-character password widens the pool from 62 to 95, worth about six bits. Adding four more characters to the same password is worth roughly twenty-four. Length is the cheapest strength available.
It is safe in the sense that the analysis runs in your browser and nothing is transmitted, but the safer habit is to test a password of the same shape instead. Save the real one for a password manager, which never needs it analysed.