Password Strength Checker
Measure a password's real strength in bits of entropy, see how long it survives an attack, and find out what weakens it.
Measure a password's real strength, see how long it survives an attack, and what weakens it.
Strength
Reasonable
56 bits of entropy
Cracked 1.4 years at the selected attack speed.
Contains what looks like a year, a very common and predictable ending.
Follows the Capital, word, numbers, symbol pattern that guessers model directly.
Under 12 characters. Length matters more than any other single factor.
Uses all four character types.
Everything here runs in your browser and nothing is transmitted. Even so, test a password similar to yours rather than the real one. Four random words beat a short password with symbol substitutions.
Verdict: Reasonable
Entropy: 56.3 bits
Character pool: 95
Time to crack: 1.4 years
Problems:
- Contains what looks like a year, a very common and predictable ending.
- Follows the Capital, word, numbers, symbol pattern that guessers model directly.
- Under 12 characters. Length matters more than any other single factor.
Working in its favour:
- Uses all four character types.About the password strength checker
Most strength meters count character types and call anything with a capital, a number and a symbol strong. That is why Passw0rd! scores well and falls in seconds: it follows exactly the pattern guessing software tries first.
This measures the search space instead, then penalises the patterns that make a password far easier to guess than its length suggests: dictionary words, keyboard runs, repeated characters and years. Everything runs in your browser and nothing is transmitted.
How to use it
- 1Type a password to test.
- 2Choose the attack speed you want to assume.
- 3Read the verdict, entropy and time to crack.
- 4Look at the listed problems and fix them.
Questions
Is my password sent anywhere?
No. The analysis runs entirely in your browser and nothing is transmitted or stored. Even so, prefer testing a password similar to yours rather than the real one.
What is entropy?
A measure of how many guesses an attacker must make, in bits. Each extra bit doubles the work. Under 40 bits is weak, over 70 is strong against an offline attack.
Why does adding a symbol help so little?
One symbol adds a few bits. Four more characters add far more. Length beats complexity, which is why four random words beat a short password with substitutions.
Which attack speed should I assume?
For an account behind rate limiting, the online figure. For a password protecting a file or a leaked database, assume offline and fast, because that is what an attacker with the hashes actually has.