Password Strength Checker
Check password strength with entropy estimate, crack-time, and detailed checks.
Written by Anil Gautam · Updated
How is the strength rating calculated?
The checker builds a character pool from what your password contains: 26 for any lowercase letter, 26 for uppercase, 10 for digits and 32 for anything else, including spaces and accented letters. Entropy is the length multiplied by log2 of that pool. The rating comes from entropy alone: under 25 bits is Very weak, 25 to 49 Weak, 50 to 74 Fair, 75 to 99 Strong and 100 or more Very strong. One override applies: an exact match with any of 20 well-known passwords, such as qwerty or letmein, is rated Very weak, ignoring capital letters.
Crack time assumes an attacker makes 10 billion guesses a second and has to try every combination. Eight random lowercase letters give 8 × 4.70 = 37.6 bits, shown as 38 and rated Weak. That is 26 to the power of 8, about 209 billion combinations, and at that rate the tool reports 21 seconds.
Why can a predictable password still score well?
The formula treats every character as if it were chosen at random. Monsoon@2024 has 12 characters from all four groups, so it gets 79 bits, a Strong rating and all eight checks passed. Attackers start with dictionary words, a capital first letter, a symbol and a recent year, so a pattern like this is among their early guesses. Read the rating as an upper limit for any password you made up yourself.
Passphrases are overrated in the same way. "correct horse battery staple" is 28 characters of lowercase letters and spaces, so the pool is 58 and the tool reports 164 bits. Had those four words been drawn at random from a list of 2,048 words, each would carry 11 bits and the real figure would be 4 × 11 = 44 bits.
What do the eight checks tell me?
The checklist is advice and does not feed into the rating. Its pattern tests are narrow: the sequence test catches only abc, bcd, cde, 123, 234, 345, qwe and wer, so 789 and xyz pass, and the repeat test flags three identical characters in a row, such as aaa, while aa passes. Aaaa1111@@@@ fails the repeat test yet is rated Strong at 79 bits, and a random 8-character string such as 7Xq9mPz2 passes six checks but is rated Weak at 48 bits.
Length moves the score fastest, since each extra character from the full 94-character pool adds about 6.55 bits. For a password that earns its rating, create one with the Password Generator and paste it here to compare.