Password Strength Checker

Instantly analyze how strong your password is.

Password Strength Checker makes this small but important security step practical to actually do. Password Strength Checker lets you do this quickly and safely without relying on anything else. The whole process happens locally in your browser; nothing is sent to a server.

Step-by-step

Type the password you want to assess into the Password field. If you'd rather not type the real one, use a stand-in with the same length and the same mix of characters.
Click Run.
Read the strength rating and any weak points the result mentions.
Make the password longer or replace its predictable parts, run it again and watch how the rating changes.

Example

For years you have used a pattern like "Chicago1990!": a city, a year and an exclamation mark at the end. Because it mixes upper case, digits and a symbol, it may score reasonably at first glance. Yet that structure is one of the first patterns password-cracking tools try. Test a phrase of a few unrelated words of similar length and compare the two results. It is a quick way to see that length tends to add more strength than another symbol does.

Why does a strong password come from length?

Programs that try to crack passwords test common patterns first, then scan possible combinations. Each extra character multiplies the possibilities: an 8-character password of lowercase letters has about 2×10¹¹ combinations, while a 12-character password using every character type has about 5×10²³. That is why a long random password is usually stronger than a short one dressed up with symbols.

Practical rules for password security

Use a separate password for every account so one leak does not affect the others.
Use a password manager so you do not have to memorise long random passwords.
Turn on two-step verification wherever it is offered.
NIST's current password guidance encourages length and checking passwords against known breach lists; it favours changing a password after suspected compromise over forced complexity rules and scheduled changes.
If you must write a password down, keep it in an encrypted manager; sticky notes on a screen are not safe.

If you would rather not type your real password, try a stand-in of the same length and structure; the result will be similar.

Things to keep in mind

Strength meters judge rules and character variety. They can't tell whether a password already appeared in a breach, so check that separately.
Names, birth years, team names and keyboard runs like qwerty weaken a password even when it looks complex.
Swapping letters for look-alike digits, such as 4 for a or 0 for o, is well known to cracking tools and adds little.
Even a password that scores well shouldn't be reused across accounts.