Password Strength Checker

Test how strong your passwords are

Password Strength Checker scores a password from 0 to 10 using length tiers, character variety, repetition checks, common-pattern checks, and character uniqueness. It also estimates entropy and a rough offline crack-time range, all computed locally in your browser.

Content reviewed: August 27, 2026

Encrypted with HTTPSProcessed in your browser

All processing runs locally in your browser. Your files and text are not sent to Tool-web's server.

Actions:

How to Use

Enter a password to test
View the real-time strength score
Check the estimated crack time
Review improvement suggestions

Features

Real-time strength analysis
Crack time estimation
Character type breakdown
Improvement suggestions
Common password detection

Tips for getting Password Strength Checker right

Length beats complexity: a 16-character passphrase outscores an 8-character symbol soup
Passphrases of 4–5 unrelated words are memorable and score high — try correct-horse-battery style patterns
A strong score doesn't mean safe if the password was reused elsewhere — uniqueness per site matters more than any score
Use the entropy and feedback together rather than treating the color label as the whole story

What the score rewards

Criterion	Points
Length ≥ 8 / ≥ 12 / ≥ 16 characters	+1 each (max 3)
Contains lowercase letters	+1
Contains uppercase letters	+1
Contains digits	+1
Contains special characters	+1
No runs like 'aaa'	+1
Doesn't start with a common password	+1
≥ 60% unique characters	+1

Honest limitations

This is heuristic scoring, not breach detection — it cannot know whether a password appeared in a leaked database
Crack-time estimates assume fast offline guessing against one account; real attackers also use phishing and reuse
Patterns not covered by the rules (keyboard walks like qwertyuiop mid-string) can fool any local scorer

Real-World Use Cases

Testing whether a new password is clearly stronger than an old one
Teaching teammates or family members what weak password patterns look like
Checking a passphrase before adopting it across an account rollout
Comparing a short complex password against a longer simpler one
Reviewing feedback prompts before saving a credential in a password manager

Best Practices

Favor length first, then add variety and uniqueness rather than relying on symbol clutter alone
Use the recommendations list as a prompt to rewrite the password rather than patching one character at a time
Store strong results in a password manager instead of simplifying them for memory
Treat reuse as a separate risk even when the score looks excellent
Use passphrases or generated passwords for important accounts and verify them here only as a sanity check

Common Mistakes to Avoid

Assuming a high score means the password has been checked against real breach data
Treating the crack-time estimate as a guarantee rather than a rough heuristic
Using a strong-looking password across multiple accounts anyway
Adding symbols to a short common word and assuming that alone makes it safe
Ignoring the uniqueness and repetition warnings when the password still looks varied at a glance

Troubleshooting

If a password scores lower than expected, check whether it lacks one character class or repeats a pattern too often
If the estimate still says weak after adding symbols, increase the length because length drives the result heavily
If a phrase seems strong but scores modestly, inspect whether it begins with a common password pattern
If the output looks reassuring but the password was reused elsewhere, treat it as compromised for practical purposes
If you need breach detection, use a dedicated breach-checking service in addition to this local checker

Frequently Asked Questions

How is password strength measured?

Strength is measured by length, character variety (uppercase, lowercase, numbers, symbols), unpredictability, and absence of common patterns.

What is a strong password?

A strong password is at least 16 characters long with a mix of uppercase, lowercase, numbers, and symbols, avoiding common words and patterns.

Does it check against known breaches?

No. It checks for common password patterns locally, but it does not compare your password against a real breach database.

Privacy & Security

Scoring happens entirely in your browser using JavaScript. Your password is never transmitted, logged, or stored — verify with your network tab if you want proof.

Tips & Best Practices

Length beats complexity: a 16-character passphrase outscores an 8-character symbol soup
Passphrases of 4–5 unrelated words are memorable and score high — try correct-horse-battery style patterns
A strong score doesn't mean safe if the password was reused elsewhere — uniqueness per site matters more than any score
Use the entropy and feedback together rather than treating the color label as the whole story

Comments

Name

Comment

0/1000

Explore more Calculators

Browse all tools in the Calculators collection.

View all Calculators

Tips for getting Password Strength Checker right

Length beats complexity: a 16-character passphrase outscores an 8-character symbol soup

Passphrases of 4–5 unrelated words are memorable and score high — try correct-horse-battery style patterns

A strong score doesn't mean safe if the password was reused elsewhere — uniqueness per site matters more than any score

Use the entropy and feedback together rather than treating the color label as the whole story

Criterion

Points

Length ≥ 8 / ≥ 12 / ≥ 16 characters

+1 each (max 3)

Contains lowercase letters

Contains uppercase letters

Contains digits

Contains special characters

No runs like 'aaa'

Doesn't start with a common password

≥ 60% unique characters

Honest limitations

This is heuristic scoring, not breach detection — it cannot know whether a password appeared in a leaked database

Crack-time estimates assume fast offline guessing against one account; real attackers also use phishing and reuse

Patterns not covered by the rules (keyboard walks like qwertyuiop mid-string) can fool any local scorer

Real-World Use Cases

Testing whether a new password is clearly stronger than an old one

Teaching teammates or family members what weak password patterns look like

Checking a passphrase before adopting it across an account rollout

Comparing a short complex password against a longer simpler one

Reviewing feedback prompts before saving a credential in a password manager

Best Practices

Favor length first, then add variety and uniqueness rather than relying on symbol clutter alone

Use the recommendations list as a prompt to rewrite the password rather than patching one character at a time

Store strong results in a password manager instead of simplifying them for memory

Treat reuse as a separate risk even when the score looks excellent

Use passphrases or generated passwords for important accounts and verify them here only as a sanity check

Common Mistakes to Avoid

Assuming a high score means the password has been checked against real breach data

Treating the crack-time estimate as a guarantee rather than a rough heuristic

Using a strong-looking password across multiple accounts anyway

Adding symbols to a short common word and assuming that alone makes it safe

Ignoring the uniqueness and repetition warnings when the password still looks varied at a glance

Troubleshooting

If a password scores lower than expected, check whether it lacks one character class or repeats a pattern too often

If the estimate still says weak after adding symbols, increase the length because length drives the result heavily

If a phrase seems strong but scores modestly, inspect whether it begins with a common password pattern

If the output looks reassuring but the password was reused elsewhere, treat it as compromised for practical purposes

If you need breach detection, use a dedicated breach-checking service in addition to this local checker