Password Strength Checker

What the password strength checker does

Most "strength meters" only count characters and reward you for adding a capital letter and a digit. This tool goes further. It calculates the entropy of your password in bits, based on its length and the pool of characters it draws from, and then subtracts penalties for the patterns cracking software tests first: common passwords, dictionary words with leet substitutions, keyboard walks like qwerty, sequences like 1234, repeated characters, years and dates, and the predictable "Word123!" shape. The result is a score from 0 to 4, a plain-language label, and an estimate of the time to crack for a throttled online attack, an offline attack against a fast hash, and a large GPU cluster.

How to use it

• Type or paste a password in the box. Results update as you type.
• Use the Show button if you want to double check what you entered.
• Read the list of weakening patterns and the three concrete suggestions below it.
• Adjust the password and watch the entropy and crack time change.

Nothing is sent to a server. There is no network request, no logging and no storage. You can confirm this in your browser's developer tools, or disconnect from the internet and keep using the page. If you would rather start from scratch, the password generator creates random passwords and passphrases.

Why it matters

Attackers rarely guess passwords one at a time. When a database of hashed passwords leaks, they run billions of guesses per second offline, starting with lists of the most common passwords and then applying rules such as capitalizing the first letter or appending a year. A password that looks complicated to a human, such as Summer2024!, falls in seconds because it follows a pattern the tools already know. Length beats complexity: each extra character multiplies the work for an attacker, which is why a four-word passphrase often beats a short string of symbols.

The crack times shown here are estimates based on the average number of guesses needed, not guarantees. Real attacks depend on how the site stores your password and whether it appeared in a previous breach. The most reliable protection is a unique, random password for every account, stored in a password manager, combined with two-factor authentication. For the websites and mailboxes we build and host at Digzy Technology, we enforce strong credentials and two-factor logins by default, because a weak admin password is still the most common way a site gets compromised.