Password strength checker
A password strength checker estimates how many guesses an attacker needs before reaching your password. This one looks for the patterns cracking tools try first — dictionary words, keyboard runs like qwerty, years, repeated chunks, and letter-to-number swaps — instead of just counting character types.
The check runs entirely in your browser. There is no network request, no logging, and no analytics on this field — you can open your browser's network tab and watch it stay empty.
How this checker works
Most strength meters count character classes: one uppercase, one number, one symbol, green bar. That method is why P@ssw0rd1! gets a passing grade on half the signup forms on the internet while falling to a cracking tool in under a second.
This checker scores the cheapest way an attacker would actually guess your password. It searches the string for the patterns cracking software tries first, and charges each match what that pattern really costs:
- Dictionary words — matched against a 15,000-word list of common English words, names, and stock passwords, after undoing leet substitutions like 4 for a and 0 for o.
- Keyboard runs — qwerty, asdfgh, and their reverses, in any position.
- Years and dates — anything shaped like 19xx or 20xx.
- Repeats — a chunk repeated, like abcabc, which adds length but almost no work.
- Counting runs — 1234, 9876, and their neighbours.
Characters left over after those matches are charged at the full per-character rate. The approach follows Dropbox's zxcvbn research, re-implemented here so it can run with no third-party code and no network access.
What the entropy bands mean
| Entropy | Rating | What it means in practice |
|---|---|---|
| Under 28 bits | Very weak | Falls to an offline attack in seconds. Common words and short strings live here. |
| 28 to 45 bits | Weak | Survives a throttled login form. Does not survive a leaked database. |
| 45 to 60 bits | Fair | Acceptable for accounts you would not mind losing. Not for email or banking. |
| 60 to 80 bits | Strong | Resists offline attacks on current hardware. A reasonable everyday target. |
| Over 80 bits | Very strong | Out of reach of brute force. Your remaining risks are phishing and reuse. |
Why "time to crack" needs three numbers, not one
A single crack-time figure is always misleading, because the speed depends entirely on how the website stored your password — a decision you had no part in. The same password can be worth minutes or millennia:
- Against the live login form, rate limiting caps an attacker at roughly 100 attempts per second. Almost anything survives this.
- Against a stolen database of fast hashes (MD5, SHA-1, unsalted), a GPU cluster reaches 100 billion guesses per second. This is the number that matters, and it is the scenario you should assume.
- Against a properly stretched hash — PBKDF2 with 600,000 iterations, bcrypt, or Argon2 — the same hardware manages a few hundred thousand per second. Key stretching is worth roughly 20 bits of free entropy.
What to do with a weak result
Do not patch it. Adding an exclamation mark to a word that was already in a wordlist gains you under one bit. Replace it outright with a randomly generated password, or with five random words if it is a password you have to type from memory.
And fix reuse before you fix strength. A perfect password used on two sites is weaker than two mediocre ones, because the first breach hands over the second account for free.
Password strength FAQ
- Is it safe to type my real password into a strength checker?
- Into this one, yes — the check runs entirely in your browser with no network request, and you can verify that in your browser's network tab. Be far more careful elsewhere: any checker that submits a form or shows a loading spinner is sending your password to somebody's server.
- How is password strength actually measured?
- In bits of entropy, which is the base-2 logarithm of the number of guesses an attacker needs on average. Each additional bit doubles that work. A checker that only counts character types is measuring the wrong thing, because it cannot see that your password is a dictionary word with a 4 in it.
- Why does my password score badly when it has symbols and numbers?
- Because composition is not randomness. "P@ssw0rd123!" contains every character class and is still guessed almost immediately: it is a dictionary word with the substitutions every cracking tool applies by default, followed by a counting run. This checker charges those segments what they actually cost an attacker.
- What score should I aim for?
- At least 60 bits for ordinary accounts and 80 or more for email, banking, and anything that can reset other passwords. A random 12-character password reaches 77 bits; a random 16-character one reaches 103. Five random words reach 52, six reach 62.
- Does this checker tell me if my password was in a breach?
- No, and that is a separate and equally important question. This tool measures guessability offline. To check exposure, use Have I Been Pwned, which compares a partial hash of your password against known breach corpora without ever receiving the password itself.
More free tools
Every tool runs in your browser without an account. The generators, strength checker, and entropy calculator keep inputs local. The breach checker sends only a five-character hash prefix to Have I Been Pwned.
Password generator
A password generator creates a random string that no person would think of and no wordlist contains.
Passphrase generator
A passphrase is several random words joined together, such as "trout-canyon-mellow-drift".
PIN generator
A PIN generator picks digits at random instead of letting you reach for a birthday.
Breach check
A breach check tells you whether a password already appears in leaked data.
Entropy calculator
Password entropy measures how many guesses an attacker needs, expressed in bits.
Make one account easier today.
Start with the password you keep reusing or the bank card that still shares a PIN. MoolKey is free, and you do not need to move everything at once.