Password Strength Checker

Entropy measures how unpredictable a password is, expressed in bits, where each extra bit doubles the number of guesses an attacker must try. This checker calculates it as length multiplied by the base-2 logarithm of the character-pool size. The pool grows with each character type you include: 26 for lowercase, 26 for uppercase, 10 for digits, and 32 for symbols, so a mixed-case password with numbers and symbols draws from a pool of 94. That means a longer password adds far more entropy than simply swapping in one symbol, because length multiplies the whole pool exponent. The estimate is deliberately capped low when your password matches a known common one or relies on a predictable pattern, since those fall to a wordlist regardless of theoretical bit count. Type a password above to see its exact entropy in bits.

How fast a password falls depends entirely on how it is being attacked, so this tool shows estimated crack times across six realistic scenarios rather than a single number. A throttled online login allows only about 100 guesses per second, an unthrottled endpoint roughly 10,000, and bcrypt at cost 12 stays deliberately slow near 10,000. But if a leaked database stored your password as a fast hash, the math changes drastically: SHA-256 allows about 10 billion guesses per second, MD5 around 100 billion, and a GPU cluster attacking NTLM up to 100 trillion. The same password that would survive centuries against a throttled form can fall in seconds once a weak, unsalted hash leaks. That gap is exactly why length and randomness matter more than one clever substitution. Enter a candidate above to compare all six scenarios side by side.

Usually yes, and the reason is entropy. Because randomness scales with length, four or five unrelated random words typically produce more bits than a short eight-character string crammed with symbols, while staying far easier to remember. A short password also has fewer total positions for an attacker to search, so adding one symbol barely moves the needle compared with adding several characters. The catch is that the words must be genuinely random and unrelated; a famous quote or a predictable phrase is already in cracking wordlists. This tool includes a built-in passphrase generator where you set the number of words and the separator, plus a side-by-side comparison view so you can pit a passphrase against a symbol-heavy password on strength, entropy, and crack time. Generate both above and watch the longer passphrase usually win.

Those swaps are called leet-speak, and attackers expect them. Modern cracking wordlists automatically apply common substitutions like @ for a, 0 for o, 3 for e, and 1 for i, then test the transformed versions of every dictionary word and known password. So turning "password" into "p@ssw0rd" does not create something new; it produces a string a wordlist already generates, which is why this checker treats it as predictable and holds the strength score down. The same logic applies to keyboard walks like qwerty or asdf, repeated characters such as aaa or 111, and simple sequences. Real strength comes from length and genuine randomness, not from disguising a common word. Type your password above and the criteria checklist will flag patterns like substitutions, repeats, and sequences so you can see exactly what is weakening it.

A breach check tells you whether a password has appeared in a known data leak, which matters because attackers feed leaked credentials straight into their first round of guessing. The safe way to do this uses a technique called k-anonymity: your password is hashed locally, and only the first few characters of that hash are sent to the lookup service, which returns every leaked hash sharing that prefix. Your browser then completes the match offline, so the full password never leaves your device. This tool links out to HaveIBeenPwned, which uses exactly that partial-hash range lookup, keeping the check private. A password can score well on length and entropy yet still be unsafe simply because it was reused and already exposed elsewhere. Score your password here first, then follow the breach link to confirm it has not already leaked.