Password Strength Checker

How the check works

As you type, the page reads the value from the password field and does four things, all of them locally. First it inspects the characters and works out the size of the alphabet an attacker would have to search: 26 for lowercase, 26 for uppercase, 10 for digits, about 33 for the printable symbols this tool counts, plus one slot for any other character such as an accented letter or an emoji. Second it computes the raw keyspace as pool ^ length and converts that to bits: entropy = length × log2(pool).

16 characters, 26-letter pool  → 16 × log2(26) = 75.2 bits
16 characters, 62-char pool    → 16 × log2(62) = 95.3 bits
8 characters,  62-char pool    →  8 × log2(62) = 47.6 bits
16 characters,  1-char pool    → 16 × log2(1)  =  0.0 bits

Third, the tool hunts for the patterns that make a password dramatically cheaper to guess than its length implies. And fourth, it converts the resulting entropy into time at three attack rates. Two numbers are shown: the raw figure, which is what the string's character classes alone would give, and the adjusted figure after pattern penalties. The gap between them is usually the interesting part of the result.

The value is compared against an embedded list of the most common passwords — the kind that appear at the very top of every breach corpus — plus several hundred everyday English words. Because people rarely type their password exactly as the dictionary lists it, the check also maps leetspeak back to plain text: @ and 4 to a, 3 to e, 1, ! and | to i or l, 0 to o, 5 and $ to s, 7 to t. That means P@ssw0rd and passw0rd! are recognised for what they are, which a naive character-class count would happily score as strong.

A caution about the formula: length × log2(pool) is the correct entropy only for a value drawn uniformly at random from that pool. Human-chosen passwords are not uniform — they cluster around words, dates, names and keyboard runs — so the raw number is an upper bound. That is exactly why the pattern penalties exist, and why the adjusted figure is the one used for the strength label and the strength bar.

What is measured, and what is only estimated

The character pool, the length, and the presence of the patterns listed below are measured exactly — they are properties of the string itself. The crack time is an estimate, and it depends on assumptions you cannot see from here. It assumes the attacker knows your pool and length, that they can test guesses as fast as the stated rate, that the hash is unsalted and fast for the offline columns, and that they must exhaust, on average, half the keyspace to succeed. Two numbers are reported honestly: the time is quoted for the full keyspace, so halve it mentally for the average case.

• The pool figure is what you used, not what was available. A single lowercase letter in an otherwise numeric password widens the pool by 26 characters. The pool is a property of the string, and an attacker who does not know the string must assume you drew from the full printable ASCII set — a real-world attacker usually knows better, and uses masks and rules.
• Character classes are not the whole story. A 30-character password made of four distinct characters has the same nominal entropy as one made of thirty distinct characters under this formula, yet the former falls to a mask attack almost immediately. The tool flags long repeats, but no simple formula models every way a human builds a weak password.
• Breach exposure is invisible here. If your password already appears in a public breach corpus, its entropy is irrelevant: it will be tried first. This page has no network access by design, so it cannot check that for you. Services such as Have I Been Pwned offer a k-anonymity range API for exactly this, and password managers can check locally.
• Strength is not the same as safety. Password reuse, no second factor, a keylogger, or a recovery email that anyone can read will defeat a 200-bit password. This tool measures one property of one string.

Using it well

1. Check before you commit. Paste a candidate password, read the warnings, fix the string, re-check. Nothing you type here is stored, so it is a safe scratchpad — but it is a scratchpad, not a vault, so save the final value into your password manager before you close the tab.
2. Chase the warnings, not the bar. The bar is a summary. The warnings name the specific weakness: a dictionary word with a leet swap, a straight keyboard run, a year, a repeated block. Fixing the named problem is worth more than adding a symbol to move the bar one notch.
3. Prefer length plus randomness. If the warnings show a recognisable word, the fix is not Word1! — it is either a genuinely random 20-character string from a generator, or four or more dice words chosen by software with a consistent separator.
4. Re-check after every edit. Changing Summer2026 to Summer2027 keeps every pattern problem and moves the bar a fraction. Rewriting the middle of the string is what actually changes the result.
5. Remember the two things this page cannot see. Whether the password is reused elsewhere, and whether the service storing it hashes it properly. Both matter more than a few bits of entropy.