Password strength checker
| Characters | |
| Strength |
What is a Password Strength Checker?
A password strength checker analyzes a password and estimates how resistant it is to guessing and cracking attacks. It looks at length, character variety, unpredictability, and — critically — whether the password appears in lists of known-compromised credentials, then reports a strength rating with concrete guidance on how to improve it. It is the fastest way to answer "is this password actually good?" before you commit to using it.
To understand what the checker measures, you need to know how passwords actually get broken. The first attack is credential stuffing: attackers take username-password pairs leaked in past data breaches — billions of them circulate in public compilations — and try them automatically against other sites. If you reused a password anywhere, no amount of complexity saves you; the attacker is not guessing, they are replaying. The second is dictionary and pattern attacks: cracking tools try common passwords, dictionary words with predictable substitutions (P@ssw0rd! fools no one), keyboard walks (qwerty123), and personal information. Only the third attack is brute force — trying every combination — and its feasibility is governed by entropy, roughly the number of bits of unpredictability: each additional bit doubles the search space.
This is why modern guidance flipped. NIST Special Publication 800-63B — the most authoritative password standard in the industry — says verifiers should require at least 8 characters, should allow at least 64, should not impose composition rules (the old "must contain uppercase, lowercase, number, symbol" mandates), should not require periodic rotation without evidence of compromise, and shall check new passwords against lists of known-compromised values. Length beats complexity: a 20-character passphrase of random words is both stronger and more memorable than an 8-character soup of symbols. Our checker embodies this philosophy — it rewards length and unpredictability, penalizes patterns and breached passwords, and explains its reasoning instead of just flashing a colored bar.
An honest limitation to state plainly: no strength meter can see the future. A password rated "strong" today becomes weak the moment it appears in a breach, which is why uniqueness (never reuse) matters as much as strength, and why a password manager generating distinct random passwords per site is the single best upgrade most people can make. The checker also cannot protect you from phishing — the strongest password in the world fails if you type it into a fake login page. Strength is one layer; phishing-resistant multi-factor authentication is the next.
Our free password strength checker scores your password on entropy, length, character diversity, pattern detection, and breach-list screening, then gives specific, actionable feedback. Your password is processed instantly and never stored — it is analyzed in memory and discarded. When you are ready to upgrade weak passwords, generate strong ones with our password generator, and if you run a website, learn how passwords should be stored with our bcrypt generator guide.
How to Use the Password Strength Checker
Testing a password takes seconds:
- Type or paste your password. Enter the password you want to evaluate into the input field. Use the show/hide toggle if you want to verify what you typed. (Tip: test the candidate password before you set it anywhere.)
- Read the strength score. The checker returns a rating — from very weak to very strong — based on estimated entropy (in bits), length, and character-set size. As a rule of thumb, aim for at least 60–80 bits of entropy for important accounts; a 16-character random password from a 94-character set carries about 105 bits.
- Review the detailed feedback. The report breaks down what helped (length, uncommon characters, unpredictability) and what hurt (dictionary words, keyboard patterns, repeated characters, personal info like names or dates). Each weakness comes with a specific fix.
- Check the breach screening result. The checker compares your password against compilations of known-breached passwords. If it appears — even in a "clever" variant — do not use it, period. Attackers try exactly these variants first.
- Improve and re-test. Apply the feedback: add length (the highest-leverage change), replace dictionary words with random ones, or switch to a passphrase of 5+ random words. Re-run the check until the password scores strong and passes breach screening.
- Store it properly. A strong password you reuse is still a liability — save the final password in a reputable password manager and enable multi-factor authentication on the account. Developers securing user passwords server-side should read our bcrypt hashing guide instead of inventing their own storage scheme.
Key Features of the Password Strength Checker
Entropy-based scoring. Strength is estimated from the password's actual unpredictability (entropy in bits), not just a checklist of character types — so a long passphrase correctly outscores a short complex-looking password.
Pattern detection. The checker recognizes dictionary words, common substitutions (a→@, e→3), keyboard walks, repeated characters, sequential runs, dates, and common password structures — the exact patterns cracking tools exploit first.
Breach-list screening. Candidates are compared against databases of passwords exposed in real breaches. A match is an automatic fail, because credential-stuffing attacks try these first, at massive scale.
Actionable feedback. Every assessment explains why in plain language and tells you the single most effective improvement — usually "make it longer" — instead of vague advice.
Crack-time estimates. The report translates entropy into intuitive time-to-crack estimates at various attack speeds, making the abstract concrete: the difference between "centuries" and "afternoon" is usually just a few characters.
Private by design. Your password is processed instantly in memory and never stored, logged, or transmitted beyond the analysis request. For maximum caution with extremely sensitive credentials, test a structurally similar password rather than the real one.
| Password example | Entropy (approx.) | Verdict | Why |
|---|---|---|---|
password123 | ~0 bits effective | Instantly cracked | Top of every breach list; tried first by every attacker |
P@ssw0rd! | ~25 bits effective | Weak | Predictable substitutions on a dictionary word — in every cracking ruleset |
Tr0ub4dor&3 | ~28 bits | Weak | The famous xkcd example: hard for humans, easy for pattern-aware crackers |
correct horse battery staple | ~44 bits | Moderate | Four random words; memorable, but use 5–6 words for important accounts |
9f$Kq2#vLx8!mZ | ~79 bits | Strong | 12 random characters from a large set — infeasible to brute force |
tG7#kP2!mQ9$xR4&vN | ~105 bits | Very strong | 16 random characters — beyond any realistic brute-force attack |
The table's lesson in one line: length and randomness compound, while "clever" substitutions on common words add almost nothing. When in doubt, generate — do not invent — using our password generator.
Password Strength Checker Use Cases
Everyday users
The problem: You have used variations of the same password for years across dozens of sites. You suspect it is not great, but "it has a capital letter, a number, and an exclamation mark, so it must be fine" — the exact misconception attackers count on.
How this tool helps: Test your current passwords (or structurally similar stand-ins) and see honest ratings with explanations. Most people discover their "strong" password is a textbook pattern attack victim. Use the feedback to upgrade the accounts that matter most — email first (it resets everything else), then banking, then everything — generating fresh unique passwords with our password generator and storing them in a password manager.
Developers
The problem: You are building signup and password-change flows and need to give users useful guidance without the outdated, user-hostile composition rules ("must contain one hieroglyph") that NIST now explicitly discourages. You also need to enforce breach-list screening per NIST 800-63B §5.1.1.2.
How this tool helps: Use the checker's logic as a reference for what good client-side feedback looks like: entropy estimation, pattern warnings, and breach screening with clear explanations. Then implement server-side properly — check new passwords against a breach corpus (the k-anonymity API model means you never send full passwords), and store only salted hashes using a memory-hard function; our bcrypt guide covers the hashing side in depth.
IT administrators and security teams
The problem: A phishing simulation or audit suggests employees are using weak or reused passwords, and you need to demonstrate the risk concretely to non-technical staff — and to management, to justify MFA rollout and a password manager license.
How this tool helps: In security-awareness sessions, have people test structurally similar versions of their password habits (never real ones on a shared screen) and watch the crack-time estimates land: "your pattern falls in 3 hours; a generated 16-character password falls in longer than the age of the universe" is more persuasive than any policy memo. Pair the demo with our SSL lookup when the session covers broader account-security hygiene.
Building a Personal Password Strategy
Knowing what makes a password strong is only half the battle — the other half is a system you will actually follow across dozens of accounts. Here is the practical strategy security professionals recommend, ordered by impact.
Step 1: Get a password manager. This is the single highest-leverage security upgrade available to most people. A reputable manager (Bitwarden, 1Password, KeePass, Apple's or Google's built-in managers) generates, stores, and fills unique random passwords for every site, protected by one strong master password that only you know. It eliminates reuse — the vulnerability behind nearly all credential-stuffing attacks — and removes the memorization burden that drives people toward weak passwords. Choose one with open-source code or independent security audits, enable its breach-monitoring feature, and learn its keyboard shortcut; within a week it feels invisible.
Step 2: Craft a truly strong master password. Your master password is the one password you must memorize, so make it count: a passphrase of 6–7 truly random words (generated by dice or the manager itself, not chosen by you) gives 75–90 bits of entropy — effectively uncrackable — while remaining typable. Write it on paper and store it somewhere physically safe (a locked drawer, a safe) until it is in muscle memory; paper in your home is far safer than a weak password in your head. Never reuse the master password anywhere, and never store it digitally in plaintext.
Step 3: Triage your existing accounts. You cannot fix fifty accounts in a day, so prioritize: email accounts first (password resets flow through email, so a compromised inbox compromises everything), then financial accounts, then work accounts, then social media, then everything else. For each, generate a fresh unique password with our password generator, verify it scores well with this checker, save it in the manager, and enable multi-factor authentication before moving on. Budget fifteen minutes a day; most people clear the backlog in two weeks.
Step 4: Enable MFA everywhere it matters. Authenticator apps (or better, passkeys and hardware security keys) on email, banking, cloud storage, and social accounts. Prefer app-based or hardware MFA over SMS, which is vulnerable to SIM-swapping. Store backup/recovery codes in your password manager the day you enable MFA — the number of people locked out of their own accounts for lack of recovery codes rivals the number compromised without MFA.
Step 5: Handle the special cases. Shared accounts (streaming, family plans): use the manager's sharing features rather than texting passwords. Wi-Fi passwords: long random strings are fine — you type them once per device. PINs and device passcodes: 6+ digits minimum, and never reuse your phone PIN as your banking PIN. Security questions: treat them as secondary passwords — generate random answers ("mother's maiden name: xQ9#mZ2!") and store them, because real answers are discoverable.
Step 6: Maintain without obsessing. You do not need to rotate passwords on a schedule (NIST agrees). Instead, react to signals: breach notifications involving a site, a phishing attempt you almost fell for, sharing a password you should not have, or your manager's breach monitor flagging a reused credential. Annual hygiene — reviewing the manager's security report, updating the handful of passwords older than your manager adoption — is plenty for a well-built system.
The goal is not paranoia; it is a quiet, boring system where every account has a unique strong password, MFA guards the important ones, and you never think about passwords at all. That is what "good password security" actually feels like from the inside.
Frequently Asked Questions
What makes a password strong?
Two things: length and unpredictability (entropy), plus uniqueness (never reused across sites). A strong password has enough entropy — roughly 60–80+ bits for important accounts — that brute force is infeasible, contains no dictionary words, patterns, or personal information that shortcut guessing, and does not appear in any breach compilation. In practice, this means either a long random string (16+ characters from a password manager) or a passphrase of 5–6 truly random words.
How is password entropy calculated?
Entropy in bits is approximately length × log2(pool size), where the pool is the set of possible characters per position. A 12-character password from 94 printable ASCII characters has about 12 × 6.55 ≈ 79 bits. But this formula assumes random selection — human-chosen passwords have far less effective entropy because attackers exploit patterns, so checkers discount for dictionary words, keyboard walks, and substitutions. Each additional bit doubles the attacker's search space, which is why adding a few characters matters more than adding symbol requirements.
Are password strength meters accurate?
They are useful estimates, not guarantees. Good meters (entropy-based with pattern detection and breach screening, like this one) are accurate at distinguishing genuinely strong passwords from weak ones and at explaining why. Their limits: they cannot know if you specifically reused the password elsewhere, they cannot predict future breaches, and simple meters that only count character types wildly overrate passwords like P@ssw0rd!. Treat a "strong" rating as necessary but not sufficient — uniqueness and MFA complete the picture.
Should passwords expire every 90 days?
No — not without evidence of compromise. NIST SP 800-63B explicitly says verifiers should not require periodic password changes, because forced rotation drives predictable behavior: users pick weaker passwords and iterate them (Summer2024! → Autumn2024!), which attackers anticipate. Change a password when there is evidence it was compromised (breach notification, phishing incident, shared accidentally) — and otherwise leave a strong, unique password alone.
Is a passphrase better than a complex password?
For human-memorized passwords, yes, usually. A passphrase of 5–6 random words (chosen by dice or a generator, not by you) offers 60–75+ bits of entropy while remaining typable and memorable — far better than an 8-character "complex" password people write on sticky notes. The critical word is random: a meaningful sentence ("IlovemydogMax!") is far weaker than its length suggests because attackers use phrase dictionaries. For passwords you never type (stored in a manager), a random 16–20 character string is the best choice.
What is credential stuffing and how do I defend against it?
Credential stuffing is the automated replay of stolen username-password pairs against many sites, exploiting password reuse. Billions of breached credentials circulate freely, and stuffing tools try them at scale. Defense as a user: never reuse passwords (a password manager makes this effortless), use MFA everywhere important, and check whether your email appears in breach compilations. Defense as a site operator: screen new passwords against breach lists (NIST requires it), rate-limit login attempts, and offer MFA — preferably phishing-resistant methods like passkeys or security keys.
How should websites store passwords?
Never in plaintext, never encrypted with a reversible key, and never with fast hashes like MD5 or SHA-256 alone. Passwords must be stored as salted hashes using a slow, memory-hard key derivation function: Argon2id (current best practice), scrypt, bcrypt (with cost factor 10–12+), or PBKDF2 with high iteration counts. Each password gets a unique random salt, and the work factor should make a single hash take ~100ms+ on your hardware. Our bcrypt generator page explains the bcrypt option in detail.
Do I still need strong passwords if I use multi-factor authentication?
Yes. MFA is a powerful second layer, but the password remains the first: a weak or breached password lets attackers reach the MFA prompt, where they can attempt MFA fatigue (spamming push approvals), SIM-swap, or social-engineering attacks against help desks. Strong unique password plus MFA — ideally a phishing-resistant factor like a passkey or hardware security key — is the combination security professionals actually recommend. Think of it as a deadbolt plus an alarm: you want both.