Password Strength Checker
Check your password strength instantly. Get detailed analysis of length, complexity, and estimated crack time.
About this calculator
Type a password to see its strength, estimated entropy and rough crack time, with suggestions to improve it.
The test runs in your browser. Still, test a similar sample, not your real password.
How to use it
- Type a sample password.
- Read the strength and tips.
- Lengthen it or add randomness and test again.
How strength is estimated
Password strength is measured in bits of entropy: length × log₂(pool size). A pool of lowercase letters is 26 (4.7 bits per character), mixed case plus digits is 62 (5.95 bits) and with symbols about 94 (6.55 bits). A random 16-character password from 94 symbols has about 105 bits, which is far beyond brute-force reach. Length beats complexity: a 20-letter lowercase password (94 bits) is stronger than an 8-character mix of everything (52 bits). Real attackers use dictionaries and leaked passwords first, so predictable choices like Password1! are weak even though they tick every box.
Worked example
Entropy examples
| 8 lowercase letters | 37.6 bits (minutes to hours offline) |
| 8 mixed characters (94 pool) | 52.4 bits |
| 12 random characters (94 pool) | 78.7 bits |
| 16 random characters (94 pool) | 104.9 bits |
| 4 random common words | about 52 bits |
| 6 random Diceware words | 77.5 bits |
Runs in your browser. Nothing is uploaded.
Tips and common mistakes
- Use a password manager and unique passwords for every site.
- Prefer length: 14+ characters, or a passphrase of 5+ random words.
- Turn on two-factor authentication for important accounts.
- Never reuse your email password anywhere.
- Change a password only when it's exposed or you suspect a breach.
Frequently asked questions
What makes a strong password?
Length, randomness and uniqueness.
How long should a password be?
At least 14 characters for random strings.
Are symbols required?
Not if the password is long and random.
Is a passphrase safe?
Yes, if the words are randomly chosen.
Is it safe to type my password here?
This runs locally, but never test a real password on any website.
Should I rotate passwords regularly?
Only after exposure; current guidance discourages forced rotation.