Password Strength Checker
Check password strength with entropy calculation, pattern detection and common password matching.
Reviewed by Aygul Dovletova · Last reviewed
Diagnosing a Password You Already Have
- Paste or type the password into the input box. Strength analysis runs on every keystroke; there is no "analyze" button to click.
- Read the colored strength bar. It ranges from red (Very Weak) through orange, yellow, light green, to deep green (Very Strong). The label corresponds to a numeric score, not a marketing adjective.
- Scan the checklist underneath. Each item is a specific signal the checker found, positive or negative: "12+ characters", "Numbers only (very predictable)", "Sequential characters detected", "This is a commonly used password".
- Watch the entropy readout. It shows Shannon entropy in bits, based on the pool size inferred from which character classes appeared in the input.
- Fix the specific issues the checklist flags, then re-type the fixed version. Do not iterate by adding a single "!" - the tool scores "Password1!" almost identically to "Password1".
What the Scoring Actually Inspects
The checker runs four regex tests for character classes: /[a-z]/, /[A-Z]/, /\\d/, /[^a-zA-Z0-9]/. It layers length tiers at 8, 12, and 16 characters and subtracts points for sequential prefixes (012, abc, etc.), repeated-character runs (/(.)\\1{2,}/), and a blocklist of 25 breach passwords (password, 123456, qwerty, iloveyou, letmein, dragon). Entropy is length * log2(poolSize). This structural approach is faster than zxcvbn (microseconds, no 600KB wordlist) at the cost of missing patterns like "Tr0ub4dor&3". All analysis happens synchronously in the input handler; no fetch, no debounce, no server round-trip.
When You Need a Diagnostic, Not a Generator
- Auditing an inherited password policy at a new job - paste the example passwords your team shares in documentation to see which ones are objectively weak.
- Coaching a non-technical family member who keeps using their pet's name and a year, showing them live why that scores badly.
- Validating that a password you memorized years ago is still safe to keep using on low-stakes accounts, or whether to retire it to the vault.
- Testing whether a passphrase you built from memorable words (four-word Diceware style) actually reaches the strong band despite having no symbols.
- Demonstrating to a product manager why the "password must contain one special character" rule does not materially help, by showing equal-entropy examples with and without symbols.
- Checking a password generated elsewhere (a vault migration export, a colleague\'s suggestion) for obvious red flags before adopting it.
Where Structural Checkers Get It Wrong
Any local strength checker has blind spots. This one will rate correcthorsebatterystaple (the famous xkcd passphrase, roughly 44 bits of real entropy from a four-word Diceware-style selection) as merely "fair" because it is lowercase-only and has no symbols, even though it resists offline cracking better than P@ssw0rd! which the tool correctly flags as weak. Leet-speak substitutions that fool regexes pass the variety tests but are trivially expanded by hashcat\'s rule engine. The checker also cannot know your password has already leaked; the Have I Been Pwned (HIBP) range API would need a network call. If your password is on the HIBP list, it is weak regardless of structure - the RockYou 2012 leak alone contains 32 million real passwords that hashcat can test against a stolen hash at hundreds of millions of attempts per second. Unicode homoglyphs, keyboard walks (qwertyuiop), and theme-based patterns (ilovemoney2024) are scored only weakly negative. The tool is a screen, not a proof.
What "Strong" Actually Means in Bits
The strength bar maps to Shannon entropy thresholds from NIST SP 800-63B guidance. Below 28 bits is trivially crackable (seconds on a single GPU), 28-45 is weak (minutes to hours), 45-60 fair (days to weeks), 60-80 strong (years for a well-funded attacker), 80+ very strong. These assume slow hashing (bcrypt, Argon2); with unsalted SHA-1 like LinkedIn 2012, every band shifts down 15-20 bits because GPUs test billions of hashes per second. The HIBP database (14+ billion compromised credentials) is the backstop: 80 bits of entropy that happens to appear in HIBP has zero effective entropy against an attacker who has the wordlist.
How This Compares to zxcvbn and Have I Been Pwned
zxcvbn, Dropbox\'s strength estimator, is the gold standard for structural checking. It tokenizes the password, looks up tokens in dictionaries, models L33t substitutions, detects keyboard patterns, and estimates guesses-to-crack. It is more accurate but ships a 700KB bundle. Haveibeenpwned.com\'s range API is the complementary check: send the first 5 hex chars of your password\'s SHA-1, receive matching full hashes, check locally. Together zxcvbn plus HIBP range query is the strongest combo in 2026. This tool is the lightweight middle ground: no network, no wordlist download, instant feedback, catches the obvious problems. For a site login form, pair it with server-side HIBP; for teaching why a password is bad, this is usually enough.
Frequently Asked Questions
Why does the checker rate my long passphrase as only "fair"?
The structural checker rewards character class variety heavily. A four-word lowercase passphrase like "correcthorsebatterystaple" has roughly 44 bits of real entropy (from the word selection, not the character composition), but the regex-based pool size calculation sees only lowercase letters and computes entropy as length times log2(26), which undercounts the actual guessing difficulty. This is a known limitation of structural checkers. Tools like zxcvbn that tokenize dictionaries would score it much higher. If your site allows passphrases, do not let this tool talk you into adding symbols you will forget.
Does typing my password here ever leak it anywhere?
No. The checker runs in the input event handler with no network side effects. There is no fetch call, no Have I Been Pwned lookup, no telemetry, no analytics event containing password characters. You can open the Network tab in DevTools while typing and confirm zero requests fire. That also means the tool cannot tell you if your password is in HIBP - for that, use haveibeenpwned.com/Passwords directly, which uses k-anonymity to send only the first 5 hex chars of its SHA-1.
How is Shannon entropy calculated here?
Shannon entropy is computed as password length multiplied by log2 of the inferred pool size. Pool size is summed from detected character classes: 26 for lowercase, 26 for uppercase, 10 for digits, plus the count of matching symbol characters. A 12-character password with all classes has a pool of about 94 (including the symbol characters used), giving 12 * log2(94) or roughly 78.6 bits. This is a ceiling - it assumes the attacker has no information about your password structure. Actual guessing entropy is lower because humans pick non-uniform patterns.
Why does adding one symbol at the end barely change the score?
Because that is exactly what attacker dictionaries expect. Hashcat's rule engine has a built-in "$!" rule that appends a bang to every candidate. "Password1!" is in the RockYou wordlist expansion, so an attacker finds it in the same number of guesses as "Password1". The tool mirrors this by giving symbol presence only a small bonus if the rest of the password looks weak. For real entropy, distribute symbols unpredictably or, better, push length.
Can an 8-character password ever be strong?
Only against a legacy site that hashes slowly (bcrypt, Argon2, PBKDF2 with 600k iterations). Against raw SHA-1 or SHA-256, an 8-character all-sets password (~52 bits) falls in hours to days on a rented GPU cluster. The LinkedIn 2012 breach was 6.5 million unsalted SHA-1 hashes; commodity cracking rigs recovered roughly 90 percent of them within weeks. If you cannot control the server-side hashing, treat 8 characters as the floor and push to 14+ whenever the policy allows.
Does a long password automatically mean strong?
No. "aaaaaaaaaaaaaaaa" has 16 characters but a single repeated character; the repetition regex detects this and drops the score. Likewise "1234567890123456" trips the sequential detector. Length matters only when combined with genuine per-character unpredictability. If you typed out a fragment of the Bee Movie script and relied on length alone, an attacker's corpus-based wordlist would find it in minutes despite the high Shannon entropy.
How should I use this tool together with a password manager?
Use your manager's generator to produce new passwords; use this checker to diagnose old ones during a vault audit. Most managers show a "weak" or "reused" badge but do not break down why. Pasting a flagged password here reveals exactly which structural problem triggered the flag, which is useful when deciding whether to rotate soon or immediately. Do not type your master password here or anywhere outside your manager.
Is this checker equivalent to what a well-known site uses?
It covers the same structural signals as the basic strength meters on most signup forms (length, class mix, pattern detection). It is weaker than zxcvbn (used by Dropbox, WordPress, and many fintech sites) which adds dictionary lookups and token decomposition. For enterprise-grade checking with HIBP integration, pair this tool's output with a haveibeenpwned.com/Passwords query. No single client-side tool can be definitive because real attackers use wordlists and rule transformations that a structural checker cannot anticipate.
More Security & Privacy
AES-256 Encrypt / Decrypt Online - Free, In-Browser
Encrypt and decrypt text with AES-128, AES-192, or AES-256 in GCM, CBC, or CTR mode. PBKDF2 key derivation, entirely in your browser.
Open toolBasic Auth Header Generator
Create HTTP Basic Authentication headers from a username and password or API token.
Open toolCSP Header Generator
Build Content-Security-Policy headers with a visual form, presets and per-directive configuration.
Open toolPassword Entropy Calculator
Estimate password entropy, character pool size and crack-time ranges for online and offline attacks.
Open toolPassword Generator
Generate cryptographically secure random passwords with configurable length, character types and entropy display.
Open toolPBKDF2 Hash Generator
Derive cryptographic keys from passwords using PBKDF2 with configurable iterations, salt and hash function.
Open tool