Is it safe to type my real password here?

The check runs entirely on your device: there is no request, no log and no storage — you can verify that with the browser's network panel. Even so, the habit worth keeping is to test a password of the same shape rather than the one you actually use.

What is the difference between an online and an offline attack?

An online attack guesses through the login form and is slowed by rate limits and lockouts — the estimate assumes about 1,000 guesses per second, an upper bound for a login that limits attempts. An offline attack runs against a stolen password database on a large GPU rig at up to around 10¹⁴ guesses per second when the hash is fast. Passwords that survive the offline case are the ones that are truly strong.

Why is my long password rated weak?

Usually because it is built from dictionary words, a name or a date with a number on the end, or a leet-speak substitution. Those are the first patterns any cracking tool tries, so they count for far less than their length suggests.

What does 'bits' mean?

Entropy: how many equally likely passwords an attacker must consider, on a log scale. 40 bits is about a trillion possibilities, gone in a fraction of a second offline; 80 bits is about a trillion trillion, which takes centuries.

How do I make a weak password strong?

Make it longer, remove the dictionary word or replace it with random words from a list, and never reuse it. The generators on this site do both.

Password Strength Checker

See how a password holds up against real attacks — checked on your device, never sent anywhere.

Check how strong a password is — in your browser, without sending it anywhere. As you type, the checker scores the character pool and length in bits, spots dictionary words and leet-speak variants like p@ssw0rd, and estimates how long an offline and an online attack would take to crack it.

An eight-character password with a capital, a digit and a symbol can take far fewer guesses to crack than it looks.

Type one in; see roughly how long it would take to crack. It never leaves your browser.

0 characters · checked in your browser only — nothing is sent or stored

Strength

16+ characters
lower case
upper case
number
symbol

Runs in your browser — nothing is uploaded, nothing is stored. Close the tab and it is gone.

After the strength check

The weak passwords replaced, email first

Left: passwords that score Weak or Moderate here, some of them used on more than one site. Right: the email password replaced first, because it resets everything else, then the rest. Each one is long, random and used once, and kept in a password manager.

The email password replaced first, with two-factor on
Every Weak or Moderate password replaced, one per account
A password manager so you only remember one

900+ projects
since 2017: 4.9★
400+ five-star reviews on Fiverr: 9+ years
building WordPress and Next.js sites

Support is the whole team, not one person — reach us any time, and someone picks it up.

“He was able to deliver what was needed.”

Build Smart And Save · 3-page WordPress site · the project

Schedule a Meeting

Bring the site or the page you are working on. I lead every project, and on the call we go through it together and decide what to do first.

Schedule a Meeting

How it works

How to use the Password Strength Checker

01Type or paste a password. It stays in your browser.
02Read the verdict: length, character mix, common patterns, and an estimated time to crack.
03Fix what it flags, or generate a new one with the tools below.

Good to know

Online vs offline attacks

An online attack guesses through the login form and is slowed by rate limits. An offline attack works on a stolen password database, and with a fast hash on a large GPU rig that can reach around 10¹⁴ guesses per second — the worst case the main estimate assumes.

What actually helps

Length first, then unpredictability: no names, dates or dictionary words with a digit on the end. A password manager and two-factor authentication cover the rest.

In more depth

About the password strength checker

How this password checker estimates strength

The score starts from the size of the character pool (lower case, upper case, digits, symbols) and the length, which gives the entropy in bits for a random password of that shape. Then it looks for what attackers look for: runs of letters shaped like words count as a dictionary pick rather than random characters, and anything matching a known leaked password or its leet-speak variant is capped at a very low score.

From the bits it derives two crack-time estimates, offline and online. They are order-of-magnitude figures meant to compare candidates — a real attacker's speed depends on how the site stores passwords.

Reading the result

Very Weak and Weak: change it now. Moderate: fine for a throwaway account, not for email or banking. Strong and above: good for online accounts; Very Strong and Extremely Strong hold up even if the site's password database is stolen. Whatever the score, use a different password per site.

FAQ