Home › Text Tools › Password Security Checker
Password Security Checker
Test how strong a password is with this free password security checker. It measures length, character variety, and Shannon entropy in bits, flags predictable patterns like keyboard walks and repeats, and estimates how long an offline attack would take to crack it. The entire check runs in your browser, so nothing you type is ever sent anywhere.
How to use
- Type a password into the field. For maximum safety, test a slight variation rather than your real password.
- Click Check Strength.
- Review the length, character variety, entropy rating, and crack time estimate.
- Aim for 80 or more bits of entropy for important accounts like email and banking.
Why a long passphrase beats a short tricky password
Compare P@ssw0rd1, which looks complex, against a four word passphrase like timber wolf canyon lamp. The short password has about 52 bits of entropy and follows patterns attackers try first. The passphrase, at 22 characters including spaces, lands near 100 bits even with plain words.
Attackers do not guess randomly. They try common substitutions, dictionary words with numbers tacked on, and leaked passwords first. Length from random words defeats all of those strategies at once, and you can actually remember it.
Entropy tiers, plainly explained
Under 28 bits is very weak: crackable in seconds. A short dictionary word lives here. From 28 to 35 bits is weak: minutes to hours with modest hardware. From 36 to 59 bits is moderate: fine for low-value accounts but not for email or banking.
From 60 to 79 bits is strong: centuries of brute force at current speeds. At 80 bits and above, the password is effectively uncrackable by brute force. Aim for that tier on anything that protects your money or identity.
Frequently asked questions
What does entropy in bits mean?
Entropy measures how many guesses an attacker would need in the worst case. Each extra bit doubles the guesses: 40 bits means about a trillion combinations, 60 bits about a quintillion, and 80 bits is beyond any feasible brute force. Longer passwords and bigger character sets both raise entropy.
What score should I aim for?
Treat under 36 bits as weak, 36 to 59 as moderate, 60 to 79 as strong, and 80 or more as very strong. Use 80 plus bits for email, banking, and password manager master passwords. A random 16 character password easily clears 90 bits.
Why is length more important than complexity?
Every extra character multiplies the combinations by the size of the character set. A 16 character all-lowercase password has about 75 bits of entropy, while an 8 character mix of letters, numbers, and symbols has only about 52 bits. Length wins, which is why passphrases work so well.
What patterns does the checker look for?
It flags sequential characters like 12345 and abcdef, keyboard walks like qwerty and asdf, repeated characters like aaa, common substitutions like p@ssw0rd, and year suffixes. These patterns shrink the real search space far below what the raw entropy suggests.
How is the crack time estimated?
The estimate assumes an offline attack against a fast hash, where an attacker with strong hardware can try billions of guesses per second. Online attacks against a website are far slower due to rate limiting, but offline estimates are the safe standard because breached password databases are attacked offline.
Is it safe to type my real password here?
The check is 100 percent client-side: your password never leaves your browser and is never logged. That said, the safest habit is testing a structurally similar password rather than the exact one you use, and never testing passwords on sites you do not trust.
What is a passphrase, and should I use one?
A passphrase is four or more random words strung together, like correct horse battery staple. It is easy to remember and type, yet very long, which gives it high entropy. For accounts you must memorize, a random passphrase beats a short complex password.
What is the best way to manage passwords?
Use a reputable password manager to generate and store a unique random password for every site, and turn on two-factor authentication wherever it is offered. Then you only need to memorize one strong master passphrase.