Password strength checker
It goes beyond counting uppercase letters and symbols: it detects the patterns attackers use — common words, substitutions like @ for a, keyboard sequences, repetitions and dates — and calculates the effective entropy and time to crack in four real-world scenarios.
Processed 100% in your browser
| Online attack with rate limiting (100/h) | — |
|---|---|
| Online attack without limits (10/s) | — |
| Stolen database with slow hash (10,000/s) | — |
| Stolen database with fast hash and GPU (10 billion/s) | — |
Only the first 5 characters of the password’s SHA-1 hash are sent to Have I Been Pwned (k-anonymity): the password never leaves your browser.
Ctrl + Enter runCtrl + C copy result
How to use
- 1Type the password (show or hide it with the eye button).
- 2Check the level, entropy and estimated time for each type of attack.
- 3Read the weak points found and the tips to improve it.
- 4Optional: click “Check against data breaches” to see if it appears in public leaks.
Use cases
- Check whether the password of an important account is strong enough.
- Teach good security practices in training sessions or schools.
- Review employee passwords before an audit.
- Find out if an old password has been exposed in a breach.
Frequently asked questions
Is it safe to type my password here?
Yes. The analysis runs in your browser and the password is never sent or stored. If you use the breach check, only the first 5 characters of its SHA-1 hash are sent, which cannot be used to rebuild it (k-anonymity).
Why is “P@ssw0rd2024” weak if it has everything?
Because attackers do not try random combinations: they start with dictionaries of leaked passwords and apply typical substitutions (a→@, o→0) and years. That password falls in seconds even though it meets the classic rules.
What is Have I Been Pwned?
A public service by researcher Troy Hunt that collects over 900 million passwords exposed in real breaches. If yours appears, change it everywhere you use it.
How is the time to crack estimated?
We compute the effective entropy, discounting predictable patterns, and divide by the speed of each scenario: from an online attack limited to 100 guesses per hour to a GPU trying 10 billion per second.