Free Password Strength Checker

Test any password instantly — entropy score, estimated crack time, character analysis and personalised recommendations. Everything runs in your browser; your password is never sent anywhere.

Type or paste your password

Your password never leaves your device — analysis is 100% client-side, works offline too.

0 / 256

Password Strength –

Characters: – Entropy: – bits Est. crack time: –

Character Analysis

Lowercase letters (a–z) 0

Uppercase letters (A–Z) 0

Numbers (0–9) 0

Symbols (!@#$%…) 0

12+ characters (recommended minimum) –

No repeated characters (aaa, 111) –

No sequential runs (abc, 123, qwerty) –

Recommendations

Start typing above to see personalised recommendations.

Generate a Stronger Password Automatically →

100% client-side — no server contact

Instant analysis

Free, no sign-up needed

What This Password Strength Checker Does

Type or paste any password into the field and the analysis updates instantly with every keystroke. The strength meter and badge reflect a composite score based on entropy, character variety and pattern detection. The stats bar shows character count, entropy in bits and estimated crack time. The Character Analysis panel marks each check as pass or fail, and the Recommendations panel gives specific, actionable suggestions for the exact weaknesses found in your password.

All analysis runs entirely in JavaScript inside your browser tab. Your password is never transmitted over the network, stored anywhere, written to a cookie or logged in any form — you can verify this by opening your browser's Network tab while typing and watching that no outgoing requests are made. The tool works fully offline once the page has loaded, making it safe to use with real credentials on air-gapped or restricted devices.

Tips for Improving Your Password Score

Length is the single biggest lever. Each extra character multiplies the search space exponentially. Going from 12 to 16 characters at the same character set roughly squares the number of guesses required. Aim for 16+ on any account worth protecting.
Add all four character types — lowercase, uppercase, digits and symbols. Each new type widens the pool the attacker must sample from and adds several bits of entropy per character.
Avoid repeating characters (aaa, 111, !!!) — repetition collapses effective entropy because the attacker only needs to find which character is repeated, not which one was chosen each time.
Avoid sequential runs (123, abc, qwerty) — these appear in every serious cracking dictionary and are tested before brute force begins.
If your password scores Weak or Fair, use our Password Generator to create a cryptographically random replacement and paste it back here to confirm the improvement before storing it.
Scores of Very Strong still benefit from being unique per account. A structurally strong password that has appeared in a breach is worthless — check haveibeenpwned.com alongside this tool.

Frequently Asked Questions

Is it safe to enter my real password here?

Yes — completely. Every calculation happens inside your browser tab using JavaScript. Your password is never transmitted over the network, stored in a database, written to a cookie, or logged in any form. To verify this yourself, open your browser's Developer Tools, switch to the Network tab, type a password into the field, and watch: zero outgoing requests appear after the initial page load. The tool functions fully offline once the page has loaded — you can disconnect your internet connection and continue analysing passwords without any loss of functionality.

This privacy-first architecture is intentional and applies across the entire Convixy security tool suite. It means you can safely test real credentials for high-value accounts, internal systems and sensitive services without any privacy concern. For generating brand-new secure passwords, our Password Generator uses crypto.getRandomValues() for the same client-side, server-free approach.

What does the entropy score actually tell me?

Entropy, expressed in bits, measures how unpredictable a password is to an attacker who knows your character set but not the specific password. Every additional bit of entropy doubles the number of guesses required to crack it by brute force. A 40-bit password represents about one trillion combinations; a 60-bit password exceeds one quintillion; an 80-bit password crosses into territory that cannot be exhaustively searched within any realistic timeframe, even with a large GPU cluster running continuously for years.

This checker calculates entropy from your actual character set size — how many distinct characters you use — multiplied by password length, using the formula: entropy = length × log₂(charset size). It then applies penalties for detected weaknesses: repeated characters (such as aaa or 111) reduce effective entropy by 25%, and sequential runs (such as 123 or qwerty) reduce it by a further 20%. Both patterns appear in every serious cracking dictionary and dramatically shrink the real search space an attacker must cover, so a password containing them is far weaker than its raw character count suggests.

How is the crack time estimate calculated?

The estimate models an offline attack by an adversary using a modern GPU cluster capable of running ten billion hash attempts per second — a realistic figure for an attacker who has obtained a leaked database hashed with a fast algorithm like MD5 or unsalted SHA-256. The formula divides the total search space (2 raised to the power of the entropy bits) by the guess rate of 10 billion per second, then halves the result to give the statistically expected average time to success rather than the worst-case maximum.

This is deliberately the most demanding threat model for a brute-force scenario. Dictionary and rule-based attacks against predictable patterns — keyboard walks, common substitutions, names and dates — are orders of magnitude faster and are why the Recommendations panel calls these patterns out separately regardless of the overall entropy score. The crack time shown assumes genuinely random passwords; real-world cracking of patterned passwords is usually far faster. For applications storing user passwords, protecting against this attack model requires a slow hashing algorithm — our Bcrypt Hash Generator shows how bcrypt reduces the effective guess rate to thousands per second rather than billions.

What makes a password score "Very Strong"?

Very Strong passwords combine four factors simultaneously: sufficient length (16 or more characters), broad character variety using all four types (uppercase, lowercase, numbers and symbols), genuine randomness with no dictionary words, keyboard walks or predictable substitution patterns, and no repeated or sequential character runs. Achieving all four consistently pushes the entropy calculation above 80 bits, which places the estimated brute-force crack time at centuries or beyond on modern hardware.

The fastest path to a Very Strong score is using our Password Generator set to 16+ characters with all four character sets enabled. Paste the generated result back into this checker to confirm the score before storing it. For accounts where you must memorise the credential — your password manager's master passphrase, a device encryption key — switch to Passphrase mode in the generator to get high entropy in a word combination that is far easier to recall than a random character string.

What are the most common weak password patterns this tool detects?

The checker detects two structural categories of weakness. Repeated characters — three or more identical characters in a row, such as aaa, 111 or !!! — collapse effective entropy because the attacker only needs to identify which character is repeated, not independently choose each position in the string. Sequential runs — any three or more characters whose ASCII codes increment or decrement by one, such as abc, xyz, 123 or 987 — are flagged separately because they appear in every serious cracking dictionary and are tested before brute force begins.

The checker also detects common keyboard walks by scanning for known row sequences and their reverses: qwerty, asdfgh, zxcvbn and similar patterns. Any of these detections applies a penalty to the effective entropy before calculating crack time, because their presence means the real search space is far smaller than the raw character count implies. Beyond structural patterns, the most common real-world weaknesses — dictionary words, names, dates and predictable letter-to-symbol substitutions like p@ssw0rd — require a full dictionary check that is beyond a browser-based tool's scope. Our Password Generator avoids all of these weaknesses by producing genuinely random output.

Why do length and randomness matter more than complexity tricks?

Adding one character to a password multiplies the search space exponentially; adding a new character type only extends it linearly. A 20-character random lowercase-only password has 26²⁰ ≈ 1.97 × 10²⁸ possible values. A 10-character password using all 94 printable ASCII characters has 94¹⁰ ≈ 5.39 × 10¹⁹ — roughly one billion times fewer possibilities. Length wins decisively at any reasonable comparison point.

Complexity tricks like replacing "e" with "3", "a" with "@" or "o" with "0" add almost no real entropy because every major cracking tool applies these substitution rules automatically as a first pass. A password that passes a site's complexity checker because it contains @ and 3 may still be cracked in seconds if it is a short or predictable base word. NIST's 2024 Digital Identity Guidelines confirm this empirically: they explicitly de-emphasise mandatory complexity requirements in favour of length and genuine randomness. The practical takeaway is simple — use our Password Generator to produce genuinely random credentials, never compose passwords manually using letter substitutions.

What is the difference between a passphrase and a password, and how strong are passphrases?

A passphrase is a sequence of randomly chosen words used as a credential — for example, coral-drift-maple-scout. A 4-word passphrase drawn from a 7,776-word Diceware list has approximately 51 bits of entropy; a 5-word passphrase has about 64 bits; a 6-word passphrase exceeds 77 bits, which is strong enough for most high-value accounts. The critical requirement is that the words must be genuinely random — chosen by rolling dice or by a cryptographically secure generator — not a meaningful phrase you would naturally compose.

"ilovemycat" has almost no entropy despite being three words because the words are entirely predictable and would be cracked in seconds by dictionary-based tools. "Grape-Tunnel-Anchor-Violet" has high entropy because the words share no logical connection and were selected randomly. Passphrases earn their place as the preferred format for credentials that must be memorised — your password manager's master passphrase, a device encryption key or a backup recovery phrase. Our Password Generator includes a Passphrase mode that produces correctly randomised word combinations at configurable lengths, which you can paste here to verify their entropy score before committing to them.

When should I check existing passwords and how often should I rotate them?

Use this checker any time you are auditing your account security, immediately after a service announces a data breach, when setting up a new password manager, or when a security review prompts you to examine older credentials that may not meet current standards. The checker is fully client-side, so it is safe to use with real passwords from any account type. Complement it with a breach database check at haveibeenpwned.com to confirm that a structurally strong password has not appeared in a known credential dump — a Very Strong password that has been leaked is worthless regardless of its entropy score.

On rotation frequency: NIST's current guidance explicitly recommends against mandatory periodic rotation (such as forcing changes every 90 days) for passwords that have not been compromised, because forced rotation encourages users to make predictable incremental changes rather than genuinely new passwords. Instead, rotate immediately after any confirmed or suspected breach, when you stop using a password manager that held the credential, or when you are leaving an organisation that had access. Replace any password scoring Weak or Fair in this tool immediately, store the replacement in a dedicated password manager, and enable two-factor authentication as an additional layer on any account that supports it.

What is the difference between hashing and encrypting passwords for server-side storage?

Hashing is a one-way mathematical transformation: it converts a password into a fixed-length fingerprint that cannot be reversed without brute-force effort. Encryption is two-way and reversible with the correct key. Server-side applications must always hash user passwords — never encrypt or store them as plaintext — so that even a complete database theft does not immediately expose the original credentials. The attacker still needs to crack each hash individually, which is where hashing speed becomes critical.

Fast general-purpose algorithms like MD5, SHA-1 or unsalted SHA-256 allow ten billion guesses per second on modern GPU hardware, meaning a weak password can be recovered from its hash in seconds. Purpose-built password hashing functions like bcrypt, Argon2 and scrypt add deliberate computational work (a configurable cost factor) that slows each attempt to a few hundred or thousand guesses per second even on the best hardware. Our Bcrypt Hash Generator produces correctly salted bcrypt hashes at configurable cost factors ready for production database storage. Our Hash Generator handles fast cryptographic hashing for file integrity verification, content addressing and data comparison tasks where attack resistance is not the primary goal.

Does every account need a unique password, and how do I manage them all?

Yes — every account should have a unique password, without exception. In a credential-stuffing attack, an adversary takes breached username-password pairs and automatically tests them against hundreds of other services within minutes of the original breach becoming public. If you reuse a password, a single compromise at a low-security forum, shopping site or old service can expose your primary email, banking account, cloud storage and social media simultaneously. The structural strength of a reused password is irrelevant — once it appears in a breach list it will be tried against every other service within hours.

The practical solution is a password manager — Bitwarden (open-source, free tier available), 1Password (commercial) and KeePass (local, open-source) are all well-regarded. You remember one strong master passphrase; the manager generates, stores and auto-fills a unique 20-character random password for every other account. Use our Password Generator to create each account's credential, check it here to confirm strength, then store it in your manager. For identifier generation alongside passwords — database keys, API tokens, session identifiers — our UUID / GUID Generator and Secure Token Generator produce cryptographically random values in the formats your application expects, all client-side.

What role does two-factor authentication play alongside a strong password?

Two-factor authentication (2FA) adds a second independent credential requirement — typically a time-based one-time code from an authenticator app, a hardware security key, or an SMS code — that must be provided alongside the password. Even if an attacker obtains your password through a breach, phishing or cracking, they cannot log in without also possessing the second factor. This makes 2FA one of the most effective single security controls available, and it is especially important for high-value accounts: primary email, banking, cloud storage, your password manager and any account used for account recovery on other services.

A strong password and 2FA together provide defence in depth: the password protects against brute force and credential stuffing; the second factor protects against password theft scenarios where the attacker already has the correct password. Neither alone is sufficient for high-value accounts. Use this checker to confirm your passwords are structurally strong, enable 2FA on every account that supports it (preferably using an authenticator app rather than SMS, which is vulnerable to SIM-swapping attacks), and store all credentials in a dedicated password manager with its own strong master passphrase secured by 2FA. Our Password Generator can create the master passphrase via Passphrase mode for maximum memorability at high entropy.