Password strength
Check how strong a password is, measured in bits of entropy, entirely in your browser. Nothing is transmitted or stored.
Runs in your browser
Worth it when the password will be read off a screen and typed elsewhere.
This assumes the password was chosen at random. A memorable one is far weaker than the number suggests, because a real attacker guesses words and patterns first.
Length beats complexity: 20 lowercase letters carry more entropy than 8 characters of every class.
Generated and measured in this page. Nothing is transmitted, stored or logged.
Read this before typing a password you actually use
Nothing typed here is transmitted, stored or logged — it is measured in the page and discarded.
That said, the safest habit is not to type a password you rely on into any web page, however it behaves, because you cannot verify what a page does by looking at it. Type something with the same shape instead: the same length and the same mix of characters. The number will be identical, because that is all the calculation uses.
What the number means, and what it does not
The figure is bits of entropy assuming the password was chosen at random.
For a generated password that is exactly right. For a password a human invented,
it is an upper bound and usually a wild overestimate, because the
calculation cannot see that Tr0ub4dor&3 is a dictionary word with predictable
substitutions, or that Summer2026! is the most guessed pattern there is.
A real attacker does not try random strings. They try leaked passwords first, then words, then words with digits appended, then common substitutions. A password scoring 45 bits here might fall in seconds if it is a word.
So treat a low number as reliable bad news and a high number as provisional good news.
The thresholds
- Under 28 bits — very weak. Guessable essentially instantly.
- 28–40 — weak. Fine for something with no consequences.
- 40–60 — reasonable, if the service hashes properly and rate-limits.
- 60–80 — strong. Beyond casual offline attack.
- Above 80 — very strong; the password is no longer the weak link.
Those are calibrated against offline cracking of a stolen hash, which is the case that matters. Against a login form with rate limiting, far less is needed — but you do not get to choose which situation you end up in, because you cannot know how a service stores your password until it is breached.
If it scores badly
Length first. Adding four random lowercase letters is worth about 19 bits;
swapping an a for a @ is worth almost nothing, because every cracking tool
tries that substitution.
The genuinely good answer is a password manager and a long generated password you never see. The password generator here makes one locally if you want it.
Nothing is uploaded
Measured in this page.