Password Strength Checker

Password Strength Checker does not count characters and award points for variety. It reads the password from left to right and takes the longest recognisable pattern at each position: entries from a built-in list of 195 very common passwords and words from a 1,289-word dictionary, either spelled out or with l33t substitutions such as 4 for a or $ for s; ascending and descending runs; walks along a keyboard row; dates and four-digit years; and blocks that simply repeat. Each matched segment is priced at the guesses it costs someone whose software already knows that pattern, every unmatched character is priced at the size of its own character class, and the segment prices are multiplied together with a further factor for the order the segments could have been assembled in. The total is then held at or below plain brute force over the whole password, so the segmentation only ever lowers the estimate.

The 0 to 4 rating is deliberately the lower of two views. One is that raw guess count. The other is how long the password would last if the service storing it leaked its database and the hashes were attacked on GPUs at ten billion guesses a second — anything falling in under an hour is capped at Weak, under a year at Fair, under a century at Strong. Without that cap a password that dies in an afternoon of GPU work would carry a green Very strong label, which is precisely the reassurance people act on. The report lists all four scenarios one under the other: rate-limited online guessing at 100 an hour, unthrottled online guessing at 10 a second, bcrypt at 10,000 a second, and the fast-hash GPU figure. The same password is comfortable on the first line and finished on the last.

The honest limit is the wordlist. Fewer than 1,500 built-in entries stand in for what real cracking software carries: millions of leaked passwords, plus names, places, lyrics and film titles across dozens of languages, all run through mangling rules. A password built from an uncommon English word, a word in another language, or anything drawn from your own life — a surname, a pet, a postcode — can therefore be reported as strong when a targeted attack would reach it quickly. Where a password under 16 characters rates Fair or better with nothing at all recognised inside it, the report prints that caveat beneath the score; a longer one is left to stand on its length. There is also no connection to any breach corpus, so it cannot tell you whether this exact string has already been published in a leak. If you have used it anywhere before, treat the rating as void.

Nothing you type is transmitted. The matching, the entropy arithmetic and the crack-time table are plain JavaScript running in this tab, no request is made while it works, and nothing is kept once you leave — which is why the page still functions with the network switched off, and why a password you are actively using is safe to paste in. The report masks it by default, printing bullets rather than characters, so a screenshot or a glance over your shoulder gives nothing away; the Show the password in the report checkbox reveals it, along with the unmatched random stretches in the pattern table.

Runs on your device. Your file is processed directly in this browser.