Password Strength Test

Type a password below to see how strong it really is — and how long it would take an attacker to crack it. Everything happens locally in your browser: nothing you type is ever sent to a server, logged, or stored. You can verify that yourself by opening your browser's developer tools and watching the Network tab — nothing fires when you type.

How this password strength test works

Most "strength meters" only count characters and character types. This one goes further, because attackers do too. It estimates the entropy of your password (how unpredictable it is) and then converts that into an estimated offline crack time, assuming a determined attacker running modern hardware at around a hundred billion guesses per second against a fast hash.

Crucially, it also looks for predictable patterns. A password like P@ssw0rd2026! looks complex, but it's just the dictionary word "password" with obvious letter swaps and a year on the end — exactly the first thing a rule-based attack tries. So the test recognises leet-style substitutions (@→a, 0→o, 3→e), strips trailing years and numbers, and checks the underlying word against a list of the most common passwords. Looking complex and being unguessable are not the same thing, and this test is built to tell the difference.

How to read your result

• Very weak / Weak: crackable in seconds to hours. Change it, especially on any account that matters.
• Fair: better, but not enough for email, banking, or your password manager's master password.
• Strong / Very strong: long and unpredictable enough that brute force is impractical. This is where you want your important passwords to land.

The estimated crack time is the headline number. "Instantly" or "a few seconds" means the password offers essentially no protection. "Effectively forever" means the maths is hopelessly against the attacker — which is exactly what a long passphrase achieves.

What actually makes a password strong

Three things, in order of importance: length, unpredictability, and uniqueness. Length matters far more than symbols — every extra character multiplies the attacker's work exponentially, while swapping letters for symbols barely helps. The most practical way to get length you can actually remember is a passphrase: four or more random, unrelated words. And no matter how strong a password is, it's useless if you reuse it somewhere that gets breached.

Want the full method? Read how to create a strong password, see how long it really takes to crack a password, or skip straight to generating one with the password generator.

Is it safe to type my password here?

Yes. This tool is deliberately built so that nothing you type ever leaves your device — there is no server call, no analytics on your input, and nothing is stored. All the analysis runs in JavaScript in your own browser. If you're cautious (and you should be), open your browser's developer tools, go to the Network tab, and type a password: you'll see that nothing is transmitted. That said, as a general habit, avoid pasting a password you actively use into any online tool you don't fully trust — testing a close variant is just as informative.

Frequently asked questions

Does a longer password really beat a more complex one?

Almost always, yes. A 16-character string of plain words is far harder to brute-force than an 8-character tangle of symbols. Length wins because difficulty grows exponentially with it, and modern guidance (including NIST's) now favours length over forced complexity.

Why does my "complex" password score badly?

Because complexity that follows a pattern isn't real complexity. If your password is a word with predictable substitutions, a keyboard walk like qwerty, or a name plus a year, cracking tools check those first. This test flags exactly those patterns.

What should I do with a weak result?

Generate a long, random replacement with the generator, store it in a password manager, and turn on two-factor authentication for the account. That combination removes the most common cause of account takeover.