Password Strength Checker
See how long a password would take to crack — offline.
Everything runs inside your browser. Your files never leave your device.
Input
Result
Ask about Password Strength Checker
Questions about what this tool does, which option to pick, or what it can and cannot handle.
The question you type here is sent to an AI provider to be answered — your files and whatever you put in the tool above are not, and the assistant cannot see them. Answers are generated and can be wrong. The tool itself is not guessing: it runs deterministic code on your device.
About the Password Strength Checker
This estimates how long a password would survive a serious guessing attack, and — more usefully — explains which of its properties are working against it.
The calculation starts with the character pool and the length, which together give a theoretical entropy. That number alone is optimistic, because attackers do not guess randomly. They begin with leaked password lists, then dictionary words, then the substitutions people believe are clever, then keyboard runs. So the estimate here is reduced for the patterns that actually shorten a real attack: appearing on lists of the most-guessed passwords, repeating characters, using a single character class, containing counting or keyboard sequences.
The time-to-crack figure assumes an offline attack — the attacker has stolen a database of hashes and is guessing against their own hardware at ten billion attempts per second, which is an ordinary rate for a modern graphics card against a fast hash. That is the pessimistic and correct assumption. A password only ever attacked through a login form with rate limiting would last far longer, but you have no way to know how the site that holds it stores it, and plenty store it badly.
Treat the result as a comparison rather than a promise. It tells you reliably that one password is far weaker than another, and it tells you when something is catastrophically weak. It cannot know whether your particular password appeared in a breach last year, which is the single most important fact about it and the one thing this page cannot see.
Nothing typed here is transmitted. That is the reason a strength checker can be safe to use at all — a page that sent your password somewhere to score it would be doing precisely what you are trying to prevent.
How to use it
- 1Type the password you want assessed into the input.
- 2Read the verdict and the entropy figure, then the list of what weakens it underneath.
- 3Change the attacker speed if you want to model a different scenario — a slow hash makes a dramatic difference.
- 4Fix whatever the tool names, or generate a new password instead, which is usually faster than repairing an old one.
Questions
- Is it safe to type a real password here?
- Safer than in most places, because the assessment runs in your browser and this page has no backend to receive anything. Verify that the way you would for any such site: disconnect from the network and confirm it still scores what you type.
- It says my password is strong. Is it definitely safe?
- It says the password is hard to guess from scratch. It cannot know whether that exact string appeared in a breach, in which case it is already on a list and its structure is irrelevant. Check it against a breach-notification service too.
- Why did substituting letters for numbers barely help?
- Because attackers applied those substitutions to their dictionaries decades ago. Turning an “a” into a “4” adds almost nothing to the search space; it merely makes the password harder for you to type.
- What entropy should I aim for?
- Sixty bits is a reasonable floor for an ordinary account, eighty and above for anything guarding money, infrastructure or a password vault. Below forty, an offline attack finishes in minutes.