Test how secure your password is — everything runs locally in your browser
Your password never leaves your browser. All checks are performed locally using JavaScript.
Password Strength analyzes a password you type in and estimates how resistant it is to guessing and brute-force attacks. It looks at length, the mix of character sets you use (lowercase, uppercase, digits, and symbols), and common weaknesses such as dictionary words, repeated characters, and predictable keyboard patterns, then reports a strength rating along with an estimate of how long a password like it would take to crack.
It is used by anyone setting up a new account, rotating a work credential, or checking a passphrase before saving it to a password manager. Because the whole check runs in your browser, you can safely test real candidate passwords without sending them anywhere.
Strength is commonly expressed as entropy in bits, which measures unpredictability. When characters are chosen randomly, entropy is calculated as length multiplied by the base-2 logarithm of the pool size (E = L x log2(R)). The pool R is the number of possible characters: 26 for lowercase only, 52 with mixed case, 62 once digits are added, and roughly 95 for the full set of printable ASCII symbols. So a random 12-character password using all 95 symbols yields about 12 x 6.55, or roughly 79 bits.
Estimated crack time comes from dividing the number of possible combinations by an assumed guessing rate. Every extra character multiplies the search space by the full pool size, which is why length matters far more than novelty of symbols. A tool like this also penalizes passwords that are not truly random: dictionary words, names, dates, sequences like 123456, and keyboard runs like qwerty are guessed early by real attackers, so their effective entropy is much lower than a raw character count would suggest.
Yes, it is completely free. The analysis runs entirely in your browser using JavaScript, so the password you type is never sent to a server, logged, or stored anywhere.
Length is the single most important factor, followed by using a mix of lowercase, uppercase, digits, and symbols. Avoiding real words, names, dates, and keyboard patterns matters just as much, since attackers try those first.
It is an approximation of how long a well-resourced attacker would need to try every combination at an assumed guessing speed. It is a relative guide, not a guarantee, because real-world attack speeds vary with hardware and whether the password is being attacked offline or online.
Length alone is not enough if the password is predictable. A word plus a couple of digits, or a common phrase, can be guessed quickly, so the tool lowers the effective strength even when the character count looks high.
Aim for at least 12 to 16 characters for important accounts. A longer random passphrase of unrelated words can be both stronger and easier to remember than a short complex string.
No. Nothing is saved between sessions, and refreshing or closing the page clears the input. There is no account, tracking, or transmission of the value.
It is safe to do so because the check is local to your browser, but as general good practice you should still change any password after evaluating it if the tool reports weaknesses.