String Byte Counter
Measure text in UTF-8 bytes, code points, UTF-16 units and graphemes.
Password Strength Checker
Estimate how long a password would survive, and see exactly what weakens it.
Nothing is transmitted, stored or logged. Even so, typing a real password into any web page is a habit worth avoiding — test a close variant instead.
Quick Tool Overview
The Password Strength Checker estimates entropy, subtracts what real cracking tools exploit — word lists, leet spellings, keyboard runs, years and common shapes — and gives crack times across four attack scenarios.
- What it does
- Estimates password strength and explains it
- You give it
- A password
- You get back
- Entropy, crack times and specific weaknesses
- Best for
- Understanding why a password is weak, not just that it is
About the Password Strength Checker
A green bar that says "strong" is useless if it cannot say why. This estimates the entropy of a password, then subtracts what a real cracking tool would exploit: words from the standard lists, leet substitutions of those words, keyboard runs, repeats, years and the Capital-word-then-digits shape that most passwords take.
The crack time is given for four scenarios, because they differ by a factor of a trillion. An online form with rate limiting, an online form without it, an offline attack on a bcrypt hash, and an offline attack on a fast hash like MD5 — which is what a breach actually hands an attacker. A password that survives centuries in the first scenario can fall in minutes in the last.
Key features of the Password Strength Checker
Four attack scenarios
Rate-limited online, unthrottled online, offline bcrypt and offline fast hash — figures that differ by a factor of a trillion.
Sees through leet substitution
P@ssw0rd is checked against the word list after the substitutions are undone, because that is exactly what a cracking tool does.
Named weaknesses
Keyboard runs, repeats, embedded years and the Capital-word-then-digits shape are each called out, so you know what to change.
Entropy after discounting
The bit count reflects predictability rather than just the character pool, which is what makes it meaningful.
Nothing is transmitted
The check runs entirely in your browser and nothing is sent, stored or logged.
How to use the Password Strength Checker
-
1
Type a password
It stays in your browser; nothing is transmitted or stored.
-
2
Read the entropy
Measured in bits, after the predictable patterns have been discounted.
-
3
Check the four crack times
The offline fast-hash figure is the one that matters after a breach.
-
4
Read the specific findings
Each weakness is named, so you know what to change rather than guessing.
Frequently asked questions
The check runs entirely in your browser and nothing is sent or stored. That said, the habit of typing real passwords into web pages is a bad one, so testing a close variant is wiser.
Because every cracking dictionary contains the leet-substituted spellings of common words. Replacing a with @ and o with 0 adds essentially nothing, and the tool applies the same substitutions before checking its word list.
Length, and unpredictability. Four or five random words beat a short string of symbols on both counts and are far easier to type. Best of all is a password manager generating something you never see.
The offline fast-hash one. It assumes the attacker has the hash and the site stored it badly, which is exactly the situation after a breach — and the one you have no control over.
Reviews of the Password Strength Checker
What people who use the Password Strength Checker think of it. Reviews come from visitors and are posted as written.
No ratings yet
Yours would be the first.
- 5 0 reviews rated 5 stars
- 4 0 reviews rated 4 stars
- 3 0 reviews rated 3 stars
- 2 0 reviews rated 2 stars
- 1 0 reviews rated 1 star
0 reviews
Newest first
No reviews yet
Be the first to rate the Password Strength Checker. It takes half a minute and no account.
Write the first reviewMore developer tools
API Key Generator
Generate prefixed API keys in the format modern providers use.
SQL Minifier
Collapse a SQL query to one line and strip its comments.
MAC Address Generator
Generate MAC addresses that are correctly marked as locally administered.
Bitwise Calculator
AND, OR, XOR, shifts and rotates, at 8 to 64 bits, shown in binary.
Query String to JSON
Turn a URL query string into structured JSON, including nested and repeated keys.
Mock JSON Generator
Describe a shape and get as many rows of matching JSON as you need.
INI to JSON
Convert an INI or config file into structured JSON, sections and all.