Security & devFreeNo signup
Free password strength checker. Estimate strength, entropy, and improvement tips locally in your browser. Nothing is uploaded.
This checker is educational and cannot know if a password appeared in a breach database.
This tool estimates entropy — how many guesses an attacker would need, expressed in bits. Each extra bit doubles the work. It runs entirely in your browser: the password you type is never sent anywhere, stored, or logged, and you can confirm that by disconnecting from the network and watching it keep working.
Compare two passwords, both plausible:
8 characters using upper case, lower case, digits and symbols — the
classic corporate rule — gives about 52 bits.
16 characters of nothing but lower-case letters gives about
75 bits.
The second is roughly eight million times harder to brute-force, and it is far easier to type on a phone. Adding a character multiplies the search space; adding a symbol only widens the alphabet slightly. This is why length is the lever worth pulling.
P@ssw0rd! scores badly anywayIt ticks every box on a complexity checklist and it is one of the first things any
cracking tool tries. Attackers do not brute-force character by character — they start
with leaked password lists and apply the obvious substitutions: a to
@, o to 0, an exclamation mark on the end. A rule that
demands a symbol produces the same handful of predictable shapes across a whole company.
Four words chosen at random from a list of 7,776 gives about 52 bits — the same as that eight-character symbol soup, and vastly easier to remember. Push to five or six words and you are past anything brute force will reach. The word random is doing the work: words you chose yourself, or that relate to each other, are far weaker than the arithmetic suggests.
A perfect score here means nothing if the password has been reused on a site that was breached. Attackers try known email and password pairs against everything else first, and no amount of entropy survives that. Unique passwords per site, a password manager to hold them, and two-factor authentication where it is offered will each do more for you than another symbol.
Part of the QuikUtil tools collection. Nothing you type here leaves your device.
No. The check runs entirely in your browser. Nothing is uploaded, stored, or logged — you can disconnect from the internet and it still works.
A measure of how many guesses an attacker needs, counted in bits. Each additional bit doubles the effort. Under about 50 bits is weak against a determined attacker; 75 and above is strong.
Almost always. Sixteen lower-case letters is about 75 bits; eight characters with symbols, digits and mixed case is about 52. The longer one is millions of times harder to crack and easier to type.
Because entropy assumes random choice, and predictable substitutions are not random.
P@ssw0rd! satisfies every complexity rule and appears near the top of every
cracking dictionary.
Yes, if they are genuinely random. Four words drawn from a 7,776-word list is about 52 bits; five or six words is comfortably strong and much easier to remember than a symbol string.
No. If the same password appears in any breach, attackers will try that email and password pair everywhere else. Use a unique password per site and turn on two-factor authentication.