About this tool
What does this checker measure?
It estimates password strength from length, character variety, unpredictability and known breach patterns, translating that into entropy bits and a practical crack-time estimate — plus concrete steps to improve the password.
How to use it
- Type a candidate password; the score updates as you type.
- Read the entropy and crack-time figures, not just the color.
- Apply the suggestions (length first), then re-check.
Examples
Tr0ub4dor&3-style substitutions add far less strength than most people expect.- Four random words beat one complex short password on both entropy and memorability.
- A password found in breach lists scores zero regardless of complexity.
Important limitations
- Strength scores estimate guessing resistance, not safety: phishing and reuse defeat strong passwords too.
- Crack-time figures assume offline guessing rates; real attackers vary wildly.
- For anything important, use a password manager plus a second factor — a strong password alone is not a strategy.
Privacy
Analysis is 100% local. Never test a real, in-use password on any website — including this one. Test candidates only, then generate the real one in a password manager.
Frequently asked questions
What matters more: length or complexity?
Length, by far. Each extra character multiplies the search space; complexity rules mostly annoy humans.
Should I still change passwords regularly?
Only on suspicion of compromise. Scheduled rotation pushes people toward weaker, predictable passwords.
Is a passphrase really enough?
Four-plus truly random words give 50+ bits of entropy — strong for most accounts when unique per site.