BrowserTools

Password Strength Checker

Entropy & brute-force resistance estimate for any password

By Guga — BrowserTools maintainer, Tbilisi, Georgia Updated 2026-09-12
Free Private No uploads
What is Password Strength Checker?

Type into the field and the page recalculates on every keystroke, entirely on your own machine. It counts the character classes you have actually used — lower case, upper case, digits, symbols — and multiplies that pool by your length to get an entropy figure, then shortens that length for anything which looks weak: a single repeated character, a date-shaped string, a long run of one character, or a match against a list of the most common passwords. The adjusted number is graded across five bands from Critical to Excellent, and each weakness that fired is listed by name underneath. Six pass-or-fail tiles cover length, case, digits, symbols and dictionary membership. A second panel converts the entropy into a time to break under four different attack rates, from a login form capped at a hundred attempts an hour down to an offline rig guessing ten billion times a second.

Test how strong a password is with an entropy-based resilience estimate that updates as you type, plus specific improvement tips. Checked 100% locally — the password never leaves your device.

Private Password Strength Checker In Your Browser

Password Strength Checker is processed locally with client-side JavaScript. Your files never touch a server, and there is no queue to wait in.

Step-by-Step

How to use Password Strength Checker

1

Type or paste a password into the Password field, and use the eye button beside it if you want to see the characters.

2

Read the tier bar and the bits of entropy printed beside it: Critical, Weak, Fair, Strong or Excellent.

3

Check the six requirement tiles, then read the Weaknesses found line for the patterns that reduced your effective length.

4

Open the Estimated brute-force resistance table and compare the four time-to-break figures across the attack rates listed.

Key Capabilities
  • Effective length is discounted for detectable structure, so a common word with digits appended scores far below the same character count in a random string.
  • The character pool is built from the classes actually present — 26 lower case, 26 upper case, 10 digits, 33 symbols — instead of assuming all 95 are available.
  • Times to break are shown against four fixed rates, from 100 guesses an hour to 10 billion a second, so one entropy figure can be read in context.
  • The whole analysis is arithmetic inside the page with no fetch call, so what you type is not transmitted anywhere.
Common Use Cases
  • A developer justifying a password policy uses the tier and bit figures to argue for a length floor instead of a symbol rule.
  • Someone vetting a team passphrase reads the offline fast-hash row to see whether the idea would survive a stolen hash file.
  • A support agent walks a customer through which of the six checks failed when a corporate policy rejects their chosen password.
Clear Answers

Frequently Asked Questions

How is the entropy figure worked out?
Pool size times effective length, in bits. The pool is the sum of the character classes present; the effective length is your real length multiplied by a penalty for each weak pattern that matched, and it is capped at four if the password is on the common list. No dictionary attack is simulated.
Why are there four different time estimates?
Same entropy, different attacker. A sign-in form limited to a hundred attempts an hour is the weakest case, an unthrottled endpoint at ten per second is next, a stolen hash file on ordinary hardware is third, and a modern rig at ten billion hashes a second is the last. The spread across those rows is why reuse hurts more than complexity.
Is twelve characters still enough?
Twelve is the floor most current guidance assumes, and length beats symbol substitution — a four-word passphrase made of ordinary words is far stronger than Xq7#mZ2. Note that a memorable phrase still scores well here, so treat the estimate as one signal rather than a verdict.
Does typing here send the password anywhere?
No request is issued from this component; the analysis is plain arithmetic and the field has autocomplete switched off. On a shared or managed machine, remember that anything pasted into a page can be read by browser extensions that have page access.

Related Guides

View all guides →
randomPassword Security in 2026: What NIST Actually RecommendsNIST now says long, random, checked against breaches beats C0mpl3x! rules. Build a 2026-proof password strategy that humans can actually follow.