Check how strong your password really is. Get an entropy score, detailed breakdown, and actionable tips. Nothing is sent anywhere.
This password strength checker estimates how resistant a password is to guessing by calculating its entropy — the number of bits of randomness it contains. It scores the password against a length-and-variety checklist, shows a live strength meter, and flags weak patterns like repeated characters and known common passwords.
Entropy here is computed as length × log2(character-pool-size), where the pool grows as you add lowercase, uppercase, digits, and symbols. That bit count maps directly to crack time: at billions of guesses per second on modern hardware, every extra bit roughly doubles the work an attacker faces. People use it to:
Because everything runs locally in your browser, your password is never uploaded or stored — there is no network call, no breach-database lookup, and no analytics event carrying the value. You can even disconnect from the internet and it still works.
The checker calculates entropy from your password's length and character pool, then maps that bit count to a label: under 28 bits is Very Weak, 28+ is Weak, 40+ is Fair, 60+ is Strong, and 80+ is Very Strong. The meter and color update live, and a checklist grades length tiers (8, 12, 16), character variety, repeated characters, and whether it matches a common password.
Entropy is the number of bits of randomness in a password, computed as length × log2(character-pool-size). Each extra bit roughly doubles the number of guesses an attacker must try. Because modern hardware can attempt billions of guesses per second offline, 40 bits falls in seconds to hours, 60 bits buys real resistance, and 80+ bits is impractical to brute-force.
Yes. Everything runs locally in your browser — there is no network call, no breach-database lookup, and no analytics event that carries the value. Your password is never uploaded or stored, and the tool keeps working even if you disconnect from the internet.
Length plus unpredictability. Aim for at least 16 characters, mix uppercase, lowercase, digits, and symbols, avoid repeated characters and dictionary words, and never reuse a password across sites. A long random passphrase from a password manager is the easiest way to clear every check.
Each extra character multiplies the search space by the full pool size (usually 70+), so adding two more letters typically grows entropy more than adding a single symbol. That is why a long passphrase like correct-horse-battery-staple is both easier to remember and harder to crack than a short cryptic string.
Reusing the same password everywhere, keeping it too short, leaning on dictionary words or names, using predictable patterns like Password1!, and repeating characters such as aaa or 111. The checklist flags repeats and common passwords so you can spot these instantly.
No. To stay fully offline and private, it never contacts a breach database or sends your password anywhere. It does compare against a small built-in list of the most common passwords, but it cannot tell you whether your specific password has appeared in a real-world data breach.