Password Strength Checker — Test How Strong Your Password Is

Most people think they have strong passwords. Most people are wrong. The 2025 Verizon Data Breach Report found that 80% of hacking-related breaches still involve weak, reused, or stolen passwords. The problem is not that people do not care about security — it is that they do not understand what actually makes a password strong.

Our free Password Strength Checker analyzes your password's entropy, detects common patterns, and estimates crack time — all in your browser. Your password never leaves your device.

What Makes a Password Strong?

A password's strength comes down to one thing: how hard it is for an attacker to guess. This is determined by four factors:

1. Length: The single most important factor. Each additional character exponentially increases the number of possible combinations. A 16-character password is billions of times harder to crack than an 8-character password.
2. Character variety: Using uppercase, lowercase, numbers, and symbols increases the "pool size" — the number of possible characters at each position. A pool of 95 printable ASCII characters gives much more entropy per character than a pool of 26 lowercase letters.
3. Randomness: A password must be unpredictable. "Password123!" uses all four character types but is trivially weak because it follows obvious patterns. True randomness — generated by a computer, not a human — is essential.
4. Uniqueness: A strong password used on multiple sites is a weak password. When one site gets breached, attackers try those credentials on every other site (credential stuffing). Every account needs its own unique password.

Password Entropy Explained

Entropy is the mathematical measure of a password's unpredictability, expressed in bits. The formula is:

Entropy = log2(pool_size ^ length)

Or equivalently: Entropy = length * log2(pool_size)

Here is what different pool sizes look like:

• 26 — lowercase letters only (a-z): ~4.7 bits per character
• 36 — lowercase + numbers: ~5.2 bits per character
• 52 — upper + lowercase: ~5.7 bits per character
• 62 — upper + lower + numbers: ~5.95 bits per character
• 95 — all printable ASCII: ~6.57 bits per character

Practical entropy targets:

• 40 bits: Weak. Can be cracked in hours with consumer hardware.
• 60 bits: Decent. Resists casual attacks but not determined adversaries.
• 80 bits: Strong. Safe against current brute-force attacks on properly hashed passwords.
• 100+ bits: Very strong. Overkill for most purposes but appropriate for master passwords and encryption keys.

Important caveat: entropy calculations assume the password is truly random. A human-chosen password that uses dictionary words, names, or patterns has far less actual entropy than the formula suggests, because attackers use smarter strategies than brute force.

Sell Custom Apparel — We Handle Printing & Free Shipping

How Crack Time Estimates Work

Crack time depends on two things: the number of possible passwords (entropy) and the speed at which an attacker can test guesses. The speed depends on the hashing algorithm used to store the password:

• MD5 (insecure): A modern GPU can test ~50 billion hashes per second. An 8-character random password (62 character set, ~48 bits of entropy) would fall in about 1 minute.
• SHA-256: ~10 billion hashes per second on a GPU. Better than MD5, but still fast enough to brute-force short passwords.
• bcrypt (cost 12): ~5,000 hashes per second on a GPU. The deliberate slowness makes brute force impractical — the same 8-character password would take ~18,000 years.
• Argon2 (memory-hard): Even slower and resistant to GPU parallelism. The current gold standard for password hashing.

When a password strength checker estimates "it would take 3 centuries to crack," that assumes a specific attack scenario. The real answer depends on how the service stores your password — something you cannot control.

Common Weak Patterns to Avoid

Attackers do not brute-force every possible combination. They use dictionaries, common patterns, and data from previous breaches. Avoid these patterns at all costs:

• Dictionary words: "sunshine," "football," "shadow" — even with capitalization and a number appended.
• Keyboard patterns: "qwerty," "1qaz2wsx," "zxcvbn" — attackers test all common keyboard walks.
• Leet speak substitutions: "p@ssw0rd," "h4ck3r," "s3cur1ty" — these are in every cracking dictionary.
• Date-based passwords: Birthdays, anniversaries, or year-based patterns like "Summer2026!"
• Appended numbers/symbols: Adding "123" or "!" to the end of a word. Crackers test these automatically.
• Common base + variations: "Welcome1," "Changeme1," "Company2026" — these are literally the first things attackers try.

Passphrases vs. Complex Passwords

A passphrase is a sequence of random words used as a password: "correct horse battery staple." Popularized by XKCD, passphrases are both stronger and more memorable than traditional complex passwords:

• "P@ssw0rd!" — 9 characters, ~30 bits of real entropy (common substitution patterns reduce effective entropy dramatically). Cracked in seconds.
• "correct horse battery staple" — 4 random words from a 7,776-word list, ~51 bits of entropy. Takes centuries to crack via brute force.
• "turnip clockwork nebula freight jazz" — 5 random words, ~64 bits. Even stronger and still memorizable with a mental story.

The key word is "random." You must generate passphrases using a random word generator (like Diceware), not by picking words yourself. Humans are terrible at being random — we gravitate toward related words, common phrases, and personal associations that drastically reduce entropy.

Why 2FA Matters Even with Strong Passwords

A strong password protects you against brute force attacks. It does not protect you against:

• Phishing: If you enter your password on a fake login page, the attacker has it — regardless of how strong it is.
• Keyloggers and malware: Software that records your keystrokes captures your password character by character.
• Server breaches: If a service stores passwords insecurely and gets hacked, the attacker gets your password from the database.
• Session hijacking: Attackers can sometimes steal your active session without ever knowing your password.

Two-factor authentication (2FA) adds a second verification step. Even if your password is stolen, the attacker cannot log in without the second factor. Ranked from strongest to weakest:

1. Hardware security keys (YubiKey, Google Titan): Phishing-resistant, cannot be remotely intercepted.
2. Authenticator apps (Google Authenticator, Authy, 1Password): Time-based codes that change every 30 seconds.
3. SMS codes: Better than nothing, but vulnerable to SIM swapping attacks. Avoid for high-value accounts.

The Case for Password Managers

The only realistic way to have a unique, random, high-entropy password for every account is to use a password manager. Popular options include:

• 1Password: Excellent UX, family sharing, travel mode, Watchtower breach alerts. $3/month.
• Bitwarden: Open source, free tier, self-hostable. Best value option. Premium is $10/year.
• iCloud Keychain: Free, built into Apple devices, passkey support. Limited to the Apple ecosystem.
• Chrome Password Manager: Free, built into Chrome, syncs across devices. Adequate but limited features compared to dedicated managers.

The workflow: let your password manager generate a random 20+ character password for every site. Memorize only your master password (make it a strong passphrase). Enable 2FA on the password manager itself.

Checking if Your Password Has Been Breached

Even a strong password is compromised if the service that stored it was breached. Check if your credentials have appeared in known breaches using Have I Been Pwned (HIBP), a trusted service run by security researcher Troy Hunt.

HIBP uses a k-anonymity model: you send only the first 5 characters of your password's SHA-1 hash. The server returns all matching hashes, and your browser checks locally. Your full password or hash is never transmitted.

Frequently Asked Questions

What makes a password strong?

Length, character variety, true randomness, and uniqueness (not reused). A 16+ character random password or a 4+ word random passphrase is strong by current standards.

What is password entropy?

Entropy measures unpredictability in bits: log2(pool_size ^ length). 60+ bits is decent, 80+ is strong, 100+ is very strong. But entropy assumes randomness — human-chosen patterns have far less real entropy than the formula suggests.

How long would it take to crack my password?

Depends on the hashing algorithm. Against bcrypt, a 12-character random password takes centuries. Against MD5, the same password falls in minutes. You cannot control how services hash your passwords, which is why 2FA matters.

Is a longer password always better than a complex one?

Generally yes. Length contributes more to entropy than complexity. A 20-character lowercase passphrase has more entropy than an 8-character "P@ssw0rd!" — and is much easier to remember.

Should I still use 2FA with a strong password?

Absolutely. A strong password does not protect against phishing, keyloggers, or server breaches. 2FA (especially hardware keys or authenticator apps) protects you even if your password is compromised.

Is it safe to check my real password here?

Yes — our tool processes everything in your browser. Your password is never sent to any server. For maximum caution, you can test a similar password with the same structure rather than your actual password.