How to use the password strength checker
- Type or paste a password into the box. Use Show if you want to see what you typed.
- Read the score from 0 to 100, the label from very weak to very strong, and the estimated time an attacker would need.
- Open the Findings list to see exactly which patterns were detected: common words, sequences, repeats, keyboard walks, years and dates.
- Follow the Suggestions, then try an improved version. For an unguessable password, create one with our Password Generator and keep it in a password manager.
A password strength test that explains its result
Many password meters simply count character types and give a green bar once you have an uppercase letter, a digit and a symbol. Attackers know this and build their guesses accordingly, which is why "Password1!" passes many checkers and falls to a cracker in under a second. This tool tries to behave more like an attacker. It looks for dictionary words, l33t substitutions such as @ for a, keyboard runs such as qwerty, sequences like 1234, repeated blocks and dates, and it estimates the cheapest way to guess your password.
The result is shown as effective entropy in bits and as an estimated crack time for two scenarios. Because the explanation is part of the answer, you learn why a password is weak rather than just being told it is.
What attackers actually do
| Technique | How it works | What it defeats |
|---|---|---|
| Dictionary attack | Tries millions of words, names and previously leaked passwords first | Any real word, name or common password |
| Rule-based mutation | Applies habits such as capitalizing, adding digits or replacing a with @ | "Dragon2024!", "P@ssw0rd" |
| Pattern attack | Tests keyboard walks, sequences, repeats and dates | "qwerty123", "abcd1234", "01011990" |
| Brute force | Tries every combination of a character set up to a given length | Short passwords of any kind |
| Credential stuffing | Reuses passwords leaked from one site on other sites | Any reused password, however strong |
The first four attack the password itself, and the checker covers them. The last attacks your habits, which no meter can measure. That is why a unique password per account matters just as much as strength.
Understanding the numbers
Entropy in bits
Entropy is the base-2 logarithm of the number of guesses needed. Roughly, under 28 bits is very weak, 28 to 40 weak, 40 to 60 fair, 60 to 80 strong and above 80 very strong for most purposes. Every extra bit doubles the work, so 10 extra bits is about a thousand times harder. The tool shows two numbers: the effective entropy after detected patterns are discounted, and the naive entropy you would get if every character were chosen at random from the pool. A big gap between them is a warning sign.
Offline and online crack times
An online attack goes through a login form. Well-designed sites lock accounts or slow down after a few failures, so a rate of 100 guesses per second is generous to the attacker. An offline attack happens after a data breach, when the attacker has the stored hashes and can test guesses on their own hardware. We assume 10 billion guesses per second, which is realistic for fast, unsalted hashes on a graphics-card rig and pessimistic for modern slow hashes like bcrypt, scrypt and Argon2. Treat the times as a comparison between passwords, not a promise.
How to build a stronger password
- Go long. Each extra character multiplies the work. Aim for 14 characters or more on important accounts.
- Use randomness, not cleverness. Random characters or random words beat a clever phrase based on your life. Dice, a generator or a password manager can supply the randomness.
- Avoid personal information. Names of pets, children, teams, cities and birth years are the first things a targeted attacker tries.
- Do not reuse. A breach on a small forum should not open your email. Use a different password everywhere.
- Turn on two-factor authentication. An authenticator app or a hardware key protects you even if the password leaks.
- Prefer a password manager. It generates and stores unique passwords so you only need to remember one strong master passphrase.
Common password myths
"Replace letters with symbols and I'm safe." Crackers have known the substitution list for decades. "P@ssw0rd" is as weak as "password". "Change it every month." Current guidance from standards bodies such as NIST recommends changing a password when you suspect compromise rather than on a fixed schedule, because forced changes lead to predictable tweaks like adding a number. "Longer is always better, even with a common phrase." A famous quotation or song lyric is in attackers' dictionaries, so length without randomness gives less protection than it appears to.
Limits of this checker
No strength meter can know whether your password appears in a private leak, how a particular site hashes passwords, or whether you reuse it. The bundled list covers about 1,600 very common choices; real attack dictionaries contain billions. Use the score as a guide to avoid obvious mistakes, not as proof of security.
Private by design
The password is analysed in your browser only. The page has no network calls that include it, stores nothing, and sets no tracking cookies. After the first load you can disconnect from the internet and the checker keeps working, which is an easy way to verify this for yourself.
Frequently asked questions
Is it safe to type my real password here?
The page analyses the password entirely in your browser; it makes no network request with it and does not store or log it. You can check this by turning off your internet connection after the page has loaded. Still, as a general habit, avoid typing live passwords into any website, and test a similar example with the same length and structure if you want to be extra careful.
What does entropy in bits mean?
Entropy measures how unpredictable a password is. Each additional bit doubles the number of guesses an attacker needs. A truly random password of 12 characters drawn from letters, digits and symbols has about 78 bits, while a password built from a dictionary word and a year may have only 20 to 30 bits even though it looks long.
Why does a long password with a common word score badly?
Attackers do not try every combination in order. They start with lists of common passwords, names, words and patterns, then apply typical tweaks such as capitalizing the first letter or adding 123. This checker models that behaviour, so "Summer2024!" scores low even though it has four character types.
How are the crack times calculated?
The time is half of the search space (2 to the power of the entropy, divided by two) divided by a guessing speed. We use 10 billion guesses per second for an offline attack on a stolen, fast-hashed database and 100 per second for an online login form with rate limits. Slow hashes such as bcrypt or Argon2 make real attacks far slower; weak hashes can make them faster.
What is a good password length in 2026?
For important accounts use at least 14 to 16 random characters, or a passphrase of five or six unrelated words. Length matters more than complexity rules, and a password manager lets you use a unique one for every site without memorizing them.
Is a passphrase better than a complex password?
A passphrase made of four or more random words, such as "orbit-velvet-ladder-pepper", is easy to remember and has plenty of entropy if the words are chosen randomly rather than from a favourite quote or song. Complex short passwords with substitutions like "P@ssw0rd" are both harder to remember and easy for crackers to predict.
Does a high score mean my account is safe?
Not by itself. A strong password does not protect you if the site leaks it, if you reuse it elsewhere or if you are tricked into typing it on a phishing page. Use a unique password for every account, turn on two-factor authentication and check whether your email appears in known breaches.
Does this checker compare my password with real leaked passwords?
It uses a built-in list of about 1,600 very common passwords, names, teams, cities and words to spot predictable choices. It is not connected to any breach database, because that would require sending your password or a part of it to a server.
Related tools
Need custom software, a faster website or help with digital projects? The team at Bilişim Ajans can help.