Password Strength Checker
See how strong a password really is. The checker looks for the patterns attackers try first — common passwords, dictionary words, names, dates, sequences and keyboard walks — estimates crack time for four real-world attack scenarios, and can check whether the password appears in known data breaches without ever sending it.
Type a password to see its realistic entropy and estimated crack time, from a rate-limited online attack to a GPU cracking rig. The checker finds weaknesses like dictionary words, l33t substitutions and dates, and the optional breach check uses Have I Been Pwned's k-anonymity API: only the first 5 characters of the password's SHA-1 hash leave your browser.
Checked in your browser. The password is never sent anywhere; the optional breach check sends only the first 5 characters of its SHA-1 hash (k-anonymity).
Zero Server Uploads
Files process in local RAM
Instant WASM Speed
No waiting queues or lags
Unlimited Batching
Convert files without limits
Suggest a Feature or Improvement for Password Strength Checker
Need custom options, higher limits, or extra format support? Let our engineering team know!
How to use Password Strength Checker
- 1Type or paste the password — it stays in your browser.
- 2Read the strength rating and the crack times.
- 3Review the weaknesses found and the suggestions.
- 4Optionally check whether it appears in known breaches.
Why length alone isn't enough
“P@ssw0rd2024!” has 13 characters, capitals, numbers and a symbol, yet it's cracked almost instantly because attackers try dictionary words with predictable substitutions and years first. This checker estimates guesses the way modern cracking tools work — by pattern — rather than by counting character types.
The crack times assume the attacker knows common patterns. A slow password hash like bcrypt slows offline attacks enormously; a fast hash like MD5 doesn't.
Breached passwords
Hundreds of millions of real passwords have leaked, and attackers try them against every site (credential stuffing). If a password appears in a breach, don't use it anywhere. The breach check compares a hash prefix with Have I Been Pwned's database; the matching happens on your device. Generate a replacement with the Strong Password Generator.
Frequently Asked Questions
Is it safe to type my real password here?
The strength analysis runs entirely in your browser and nothing is sent anywhere. The optional breach check sends only the first 5 characters of the SHA-1 hash, which can't be used to recover the password. Even so, if you're unsure, test a similar password instead.
How is crack time calculated?
We estimate how many guesses a pattern-aware attacker needs, then divide by the speed of each scenario — from 100 guesses per hour against a rate-limited login to 100 billion per second against a fast hash on GPUs.
What's a good score?
Aim for Strong or Very strong (60+ bits of realistic entropy). For your email, bank and password manager, use a long passphrase or a generated password of 16+ characters.
Is it free? Do I need an account?
It's completely free with no sign-up and no daily credits.
Guides & Tutorials
Related Tools
Strong Password Generator
Generate strong, random passwords with the exact length and characters you need.
Password Entropy Calculator
Calculate password entropy in bits — the naive formula and a realistic, pattern-aware estimate.
Passphrase Generator
Create strong, memorable passphrases from random words (EFF diceware list).