π Password Strength Meter
Type a password to see how strong it is. Checked 100% in your browser, nothing is sent or stored.
Strength
π‘οΈ Private by design: this check runs entirely on your device. No password is transmitted, logged, or stored anywhere.
How to Use This Meter
This meter scores your password from 0 to 4 and explains exactly why. Type or paste into the password field and the score updates live as you type.
Type or paste a password into the field. Use the Show button if you want to see the characters.
Watch the live score update from 0 (Very weak) to 4 (Very strong), with a strength bar showing the result at a glance.
Read the estimated crack time and entropy in bits to see the raw math behind the score.
Follow the specific suggestions list: each item tells you one concrete change that raises the score. Use the Generate button for a ready-made strong password.
How the Score Is Calculated
The meter starts with a length score because length is the single biggest factor in password strength. Then it adds a bonus of up to 2 for character variety: lowercase, uppercase, digits, and symbols. Each extra class beyond the first adds one point. After that it subtracts for the mistakes that attackers exploit: being on the built-in list of the most common passwords costs 2 points, repeated characters like "aaa" cost 1, keyboard or alphabetical sequences like "abc" or "123" cost 1, and using only one character class in a short password costs 1. The final score is clamped between 0 and 4.
Entropy, shown in bits, is the mathematical version of the same idea: it is length times the log base 2 of the character set size. Every extra bit doubles the search space an attacker must explore. Crack time divides that space by 10 billion guesses per second, the approximate rate of a modern GPU password-cracking rig, and formats the result from seconds up to centuries.
Worked Example
Take "sunshine123": 11 characters gives a base of 1, plus 1 for the second character class (letters plus digits) = 2. But "sunshine" is in the common-password blocklist, so minus 2, and it ends in the "123" sequence, minus 1 more. Final: 0, Very weak. Crack time: effectively instant against a dictionary attack. Now take "Tr7$kQ9!mZ2@xP4": 14 characters gives a base of 2, plus 2 for all four character classes = 4, no penalties. Final: 4, Very strong, with about 92 bits of entropy and a brute-force crack time measured in billions of years. That is the difference length, variety, and randomness make.
Practical Advice
Aim for at least 14 characters on important accounts, and let a password manager generate and remember the random ones so every site gets a unique password. Never reuse passwords across sites: breaches happen constantly, and attackers replay stolen credentials everywhere. Turn on two-factor authentication for email, banking, and cloud accounts, since even a strong password can be phished. And if a site ever emails you your actual password back, treat that as a red flag: it means they store it in recoverable form instead of hashing it.
Frequently Asked Questions
Is this password strength checker really private?
Yes. The entire check runs in JavaScript inside your browser. Your password never leaves your device: there is no server call, no analytics event carrying it, and nothing is saved. You can even disconnect from the internet and it still works. Never type a real password into a site that sends it to a server.
What makes a password strong?
Length matters most, then unpredictability. A long password made of many character types is best: at least 14 to 16 characters mixing lowercase, uppercase, digits, and symbols. Randomness beats cleverness, so avoid words, names, dates, and keyboard patterns. A passphrase of four or five random words is also strong and easier to remember.
What does the crack time estimate mean?
The estimate divides the total possible combinations (charset size raised to the password length, halved) by a guess rate of 10 billion guesses per second, which is what a modern GPU rig can manage. It is a rough upper bound, not a guarantee: real attacks use dictionaries and patterns, so weak passwords fall far faster than the raw math suggests.
Why do common passwords score zero?
Attackers try the most popular passwords first using breach lists containing billions of leaked credentials. If your password is on that list, its length and complexity do not matter: it will be guessed in seconds. This meter checks your password against a built-in blocklist of the most common ones.
Should I use a password manager?
Yes, it is the single best upgrade most people can make. A password manager generates and stores a unique strong password for every site, so you only need to remember one master password. That also solves the real problem: reusing one good password across many sites is almost as risky as a weak one.