Password Strength Checker — Two Clocks, Not One Number
Do not type a password you actually use. Type one with the same shape — the same length and the same mix — and you will get the same reading from a stand-in.
Nothing you type is stored, sent, or compared against any list. There is no network request on this page at all.
Waiting for something to measure.
- Estimated entropy
- —
- Length
- —
- Against a login (100/sec)
- —
- Against a leak (100bn/sec)
- —
The two figures are the same password against two different attacks. A login form that slows repeated attempts is the friendly case. A stolen file of hashes on a graphics card is the hostile one, and it is the case worth planning around, because you never find out when a service is breached.
About the Password Strength Checker
Most strength meters give you one score and one enormous crack time. That time comes from assuming an attacker tries every combination of every character you happened to use, in no particular order, which is not how anybody guesses a password. Real attacks start with the passwords people already chose, move on to dictionary words, then to those words with a capital at the front and a digit or a year on the end.
This checker works the other way round. It looks for the cheap parts first — a known password, a dictionary word wearing leetspeak, a run along the keyboard, a repeated chunk, a four-digit year — and prices each one at what it is actually worth. Only the characters left over are counted as though they were random.
Then it shows two clocks instead of one, because a password does not have a single strength. Against a login form that slows down repeated attempts, almost anything survives. Against a leaked file of hashes on a graphics card, the same password can fall in seconds. The distance between those two numbers is usually the entire story, and a single figure hides it.
Nothing you type is stored, sent, or looked up. The last one is a decision rather than an omission: checking a password against a breach list means handing it, or a piece of it, to somebody else's server.
How to read the result
- Type something shaped like a password you really use — the same length, the same mix of letters, digits and symbols — rather than the password itself. The pattern is what gets measured, so a stand-in gives you the same answer.
- Watch the bolt. It moves with the estimate rather than with a checklist of character types, which is why adding one symbol to a common word barely shifts it.
- Read both clocks. The throttled one is what a website login faces. The fast one is what a leaked password file faces, and when the two disagree it is the fast one to plan around.
- Read the findings underneath. They name the part that is cheap to guess, and that part is the one worth changing. A password can be twelve characters long and still be found in under a second.
- Press the example buttons to compare a padded word with a string of unrelated words. The second is easier to remember and far slower to guess, which is the point of the whole exercise.
Frequently asked questions
Is the Password Strength Checker free, and do I need an account?
It is free, there is no account, and there is nothing to install. The page is a single file of JavaScript that runs in your browser, so it works offline once loaded.
Does my password leave the browser?
No. Nothing is sent, nothing is written to storage, and the page makes no network request while you type. You can watch that yourself in the browser's network panel, which is a better guarantee than any promise on a page.
Why not check my password against a breach list, like other checkers do?
Because that means sending your password, or a hash prefix of it, to somebody else's server. Several services do it carefully and the risk is genuinely small, but it is not zero, and we would rather this page have no way to leak anything at all. If you want a breach check, run it from a password manager you already trust with your passwords.
Why two crack times instead of one?
Because they are the same password against two different attacks. A login form that slows repeated attempts allows perhaps a hundred guesses a second; a stolen file of hashes on a graphics card allows a hundred billion. A password that survives one and not the other is common, and a single number cannot say that.
Why does adding a symbol barely help?
Because guessing programs already know the trick. Turning an a into an at sign or an o into a zero is one of the first rules they apply to every dictionary word, so it multiplies the work by about two rather than by the number of symbols on your keyboard. Another four characters of length multiplies it by millions.
How accurate is this estimate?
It is an estimate and it errs on the generous side. The dictionary here holds a few hundred words, while a real attack uses lists of hundreds of millions plus rules for combining them. Anything our list does not recognize is counted as random, so a passphrase built from ordinary words will read stronger here than it would against a word-list attack. Treat a low score as reliable bad news and a high score as encouraging rather than proven.
Should I just use a password manager instead of inventing strong ones?
For most accounts, yes, and it is a different kind of answer to the same problem. A manager makes every password long and unrelated, so no single leak spreads. The handful you still have to remember — the manager itself, your device, your email — are the ones worth building by hand from unrelated words, and those are the ones worth measuring here.