🔒 Your password is analysed entirely in your browser. It is never sent to any server.
Enter a password
0
Bits of Entropy
Entropy is the measure of unpredictability. Higher = harder to crack.
<40 bits: Weak
40–60: Fair
60–80: Strong
80+: Very Strong
Character pool size: 0 → Combinations: 0
Security Checklist
Estimated Crack Time
Assumes an attacker has your hashed password and uses offline brute-force.
🧑💻 Online attack (1K guesses/sec)—
💻 Offline slow hash (bcrypt, 10K/sec)—
🖥️ Fast hash MD5 (1 billion/sec)—
🚀 GPU cluster (100 billion/sec)—
⚡ Botnet / ASIC (1 trillion/sec)—
Improvement Suggestions
How Password Strength is Measured
Also searched as: password strength checker free | how strong is my password | password security checker | check password strength Optimized for US users with American units and terminology.
Password strength is measured by entropy — the number of bits needed to describe all possible combinations. Entropy = log₂(pool_size^length). A 12-character password using all 94 printable ASCII characters has 94^12 combinations ≈ 2^78.6 — about 79 bits of entropy. Longer passwords and larger character pools both increase entropy multiplicatively. A 20-character lowercase-only password (26^20 = 66 bits) beats a 10-character complex password (94^10 = 65 bits).
Use the Password Strength Checker above — enter your values and get instant results. This free online tool calculates how to check if password is strong without any download or signup required. Results update in real time as you type.
Use the Password Strength Checker above — enter your values and get instant results. This free online tool calculates password strength tester free without any download or signup required. Results update in real time as you type.
Entropy (bits) = log₂(character_pool_size ^ password_length). Each additional bit doubles the combinations an attacker must try. 40 bits = 1 trillion combinations (cracks in seconds on modern hardware). 60 bits = 1 quintillion (months on a GPU cluster). 80 bits = effectively uncrackable by any foreseeable technology. Length has exponential impact — adding 2 characters to an 8-character password increases entropy more than switching from letters-only to full ASCII.
Dictionary-based and rule-based attacks try predictable patterns first: common words, names, dates, followed by numbers or special characters. "Password123!" appears in millions of breach databases and rule-based wordlists. Attackers run these wordlists before brute-forcing — finding "Password123!" takes milliseconds even though its technical entropy is ~55 bits. This tool checks for common patterns and dictionary words that effectively reduce real-world entropy below the theoretical calculation.
For random passwords, yes — length dominates. A 20-character lowercase random string (26^20, ~94 bits) beats a 10-character full-ASCII password (94^10, ~65 bits) despite using only one character type. However, adding character types still helps: 12 lowercase chars = ~56 bits vs 12 full-ASCII chars = ~79 bits — a 23-bit difference that multiplies combinations by 8 million. The ideal is both: 16+ characters using a mix of types. NIST guidelines now prioritise length over mandatory complexity.
Reputable services never store your plaintext password — they store a hash (one-way transformation). When you log in, they hash your input and compare hashes. The hashing algorithm determines crack resistance: MD5/SHA-1 (weak — billions/second on GPU). SHA-256 (better but still fast — billions/second). bcrypt/scrypt/Argon2 (deliberately slow — thousands/second). The crack-time estimates in this tool show why slow hashing algorithms matter so much — a 50-bit password that cracks in 1 second against MD5 takes 3 years against bcrypt.
Never — even a 100-bit entropy password becomes worthless if reused, because data breaches expose passwords directly (if the site stores them poorly) or allow credential stuffing attacks. When one site is breached, attackers try the same email/password combination on thousands of other sites. The solution: use a password manager (Bitwarden, 1Password, KeePass) to generate and store a unique random password for every site. You only need to remember one strong master password. Enable 2FA on all important accounts as a second layer of defence.