Is my password sent to a server?

No. Every calculation — entropy, crack-time estimate, and the suggestion list — runs locally in JavaScript in your browser. Nothing you type is transmitted, logged, or stored anywhere, and it disappears the moment you close or refresh the tab.

How is the entropy calculated?

Entropy in bits is roughly length × log2(character pool size), where the pool grows as you use lowercase, uppercase, digits, and symbols. That estimate is then reduced if the password is a known common password, contains a sequential run like "abc" or "123", or repeats the same character three or more times in a row — patterns real attackers check for first.

How is the crack time estimated?

It assumes an offline attack at 10 billion guesses per second, a realistic rate for cracking a stolen, unsalted-or-weakly-hashed password dump with modern hardware. Real-world numbers vary a lot depending on how the password is stored (bcrypt/argon2 slow this down enormously) — treat this as an order-of-magnitude guide, not a guarantee.

Why did a long password still get a low score?

Length alone doesn't guarantee strength. Common passwords, keyboard-adjacent sequences (qwerty, asdf), and repeated characters are heavily penalized here because they're exactly what password-cracking dictionaries and rule sets target first, regardless of length.

What's a good password length to aim for?

12+ characters mixing all four character types (lowercase, uppercase, digits, symbols) is a reasonable minimum for most accounts today. For anything high-value, prefer a long, unique passphrase generated by a password manager over anything memorable enough to type by hand.

PASSWORD STRENGTH CHECKER

Type a password and get an entropy estimate, an estimated crack time, and specific ways to make it stronger. Nothing leaves your browser.

Password

Nothing you type here is sent anywhere — the check runs entirely in your browser.

How to check a password's strength

1
Type (or paste) the password you want to check.
2
Read the strength meter, entropy estimate in bits, and estimated crack time.
3
Work through the suggestions listed below to close specific gaps.
4
Click Show/Hide to reveal or mask the password on screen.

Questions

Is my password sent to a server?: No. Every calculation — entropy, crack-time estimate, and the suggestion list — runs locally in JavaScript in your browser. Nothing you type is transmitted, logged, or stored anywhere, and it disappears the moment you close or refresh the tab.
How is the entropy calculated?: Entropy in bits is roughly length × log2(character pool size), where the pool grows as you use lowercase, uppercase, digits, and symbols. That estimate is then reduced if the password is a known common password, contains a sequential run like "abc" or "123", or repeats the same character three or more times in a row — patterns real attackers check for first.
How is the crack time estimated?: It assumes an offline attack at 10 billion guesses per second, a realistic rate for cracking a stolen, unsalted-or-weakly-hashed password dump with modern hardware. Real-world numbers vary a lot depending on how the password is stored (bcrypt/argon2 slow this down enormously) — treat this as an order-of-magnitude guide, not a guarantee.
Why did a long password still get a low score?: Length alone doesn't guarantee strength. Common passwords, keyboard-adjacent sequences (qwerty, asdf), and repeated characters are heavily penalized here because they're exactly what password-cracking dictionaries and rule sets target first, regardless of length.
What's a good password length to aim for?: 12+ characters mixing all four character types (lowercase, uppercase, digits, symbols) is a reasonable minimum for most accounts today. For anything high-value, prefer a long, unique passphrase generated by a password manager over anything memorable enough to type by hand.