Password Strength Checker

Password Strength Checker — Test How Secure Your Password Really Is

Most people can identify obviously weak passwords — 123456, password, a pet's name, a birthday. What's much harder to judge is where passwords that feel secure actually fall on the spectrum. P@ssw0rd1! has uppercase letters, lowercase letters, numbers, and symbols — it passes every legacy complexity rule. It also appears in every major password cracking wordlist because the substitution pattern (@ for a, 0 for o, ! at the end) is so well-known that attackers build it into their dictionary attack rules. Real password strength is about entropy — the actual unpredictability — not whether it superficially checks complexity boxes.

This tool analyzes the factors that genuinely determine how difficult a password is to crack, and shows you specifically where it's strong and where it has weaknesses. The entire analysis runs locally in your browser — your password is never transmitted, logged, or stored anywhere.

What Actually Determines Password Strength

Password strength is fundamentally about the size of the search space an attacker must cover — technically called entropy, measured in bits. Two factors control it:

Length is the dominant factor. Each additional character multiplies the number of possible passwords by the character set size. An 8-character password drawn from 94 printable ASCII characters has 94⁸ possible values — roughly 6 quadrillion. The same set at 16 characters has 94¹⁶ possible values — approximately 37 septillion. That's not a linear difference; it's exponential. The NIST Digital Identity Guidelines (SP 800-63B) explicitly recommend length as the primary quality driver, allowing passwords up to at least 64 characters.

Character variety increases the multiplier for each position. An all-lowercase password uses 26 characters. Adding uppercase doubles it to 52. Digits and symbols push it toward 94. This matters, but less than length — a 12-character lowercase-only password has more entropy than an 8-character password with full variety.

Randomness is the factor most people miss. Entropy calculations assume random selection. A password from a random generator has its theoretical entropy fully realized. A human-created password — even one that looks complex — typically has patterns that reduce actual entropy. Predictable substitutions, common capitalizations, and word-based structures all reduce the effective search space that attackers actually need to cover.

How Password Cracking Actually Works

Attackers rarely crack passwords in real time against a live login — rate limiting and lockouts make that impractical. The common and dangerous scenario is an offline attack: the attacker obtains a database of hashed passwords through a breach and runs cracking software locally, making millions or billions of attempts per second without any rate limiting.

Dictionary attacks: Attackers start with wordlists containing millions of common passwords, words, and phrases — including every password from every known breach. If your password appears in any breach database, it's cracked almost instantly regardless of complexity.

Rule-based attacks: Hashcat and similar tools apply transformation rules to dictionary entries: capitalize the first letter, add 1 or ! at the end, substitute @ for a, 3 for e, 0 for o. These rules come from studying how real people modify passwords to meet complexity requirements. P@ssw0rd! is a rule-based transformation of "password" — one of the first patterns any serious attacker tests.

Brute force: For shorter passwords, exhaustively trying every combination is feasible. Modern GPU hardware tests billions of combinations per second against certain hash types. An 8-character full-ASCII password can be cracked offline in hours to days. A 16-character truly random password would require centuries.

Passphrases — Length Over Complexity

One of the most important shifts in password security thinking is that long passphrases — sequences of random words — can be more secure and far more memorable than short mixed-character passwords. The XKCD comic "correct horse battery staple" illustrated this: four random common words create a password with enormous entropy that's genuinely memorable because the words create mental images.

The critical requirement is random selection. "I love my dog Max" isn't a good passphrase — it's personally meaningful and guessable from social media. Four words chosen by rolling dice on a wordlist (the Diceware method) or generated by a password manager are genuinely random. A 5-word Diceware passphrase has approximately 64 bits of entropy — more than most mixed-character passwords people actually create.

For accounts where you must type the password manually (device unlock, primary email, password manager master), a passphrase is often the most practical choice. For other accounts, use a password manager to generate and store 20+ character random passwords you never need to type or remember.

Beyond the Password — Account Security Essentials

A strong password is necessary but not sufficient. Strong passwords are defeated every day by phishing (users typing credentials into fake sites), credential stuffing (passwords from one breach tested against other sites), and malware. The complementary practices:

Unique passwords for every account: If you reuse a password and one site is breached, every account with that password is compromised. Password managers make unique passwords practical.

Multi-factor authentication (MFA): Even a perfect password is compromised if phished or leaked. MFA adds a second factor — time-based codes, hardware keys, or push notifications — that attackers can't access with just the password. Enable MFA on every account that supports it, especially email, financial accounts, and developer tools.

Password managers: Bitwarden (open source), 1Password, and KeePass generate, store, and autofill strong unique passwords. The master password plus MFA protects the vault. This eliminates the impossible trade-off between security and memorability.

Frequently Asked Questions About Password Strength