Password Strength Checker

Check how strong your password is — analysed entirely in your browser, never sent anywhere.

What is a password strength checker?

A password strength checker estimates how hard a password would be to guess. As you type, this one rates the password strength from Very Weak to Very Strong and fills a coloured bar. It looks at the length, the mix of character types, an estimate of randomness and whether the password starts with a very common choice.

Your password is checked entirely in your browser. It is never sent to our server, stored or logged.

How the password strength check works

The score is built from five simple tests, each worth one point:

  • The password is at least 8 characters long.
  • It is at least 12 characters long.
  • It uses at least three types of character: lowercase, uppercase, numbers and symbols.
  • It uses all four types.
  • Its estimated randomness reaches 60 bits, based on its length and how many different characters it uses.

The points map to six labels: Very Weak, Weak, Fair, Good, Strong and Very Strong. A password that starts with an extremely common choice, such as "password", "123456", "qwerty", "letmein", "admin", "welcome" or "iloveyou", is capped at Weak however long it is.

How to check your password strength

  1. Type or paste a password into the box.
  2. Watch the bar and label update as you type.
  3. Press Show to reveal the characters, or Hide to mask them again.
  4. If the result is below Strong, make the password longer or generate a new one.

What the password strength results mean

Very Weak to Fair passwords could be guessed quickly by automated tools and should be replaced. Good is acceptable for low-value accounts. Strong and Very Strong suit important accounts, provided the password is not reused anywhere else.

What the score cannot know

The checker measures structure, not history. It cannot tell whether a password contains your name or birthday, or whether it has appeared in a data breach. A password such as Summer2024!Garden may score well yet still be guessable because it follows a familiar pattern. Truly random passwords avoid that problem.

For important accounts, also check whether your email address appears in known data breaches using a reputable breach notification service, and change any password that was exposed.

What makes a password strong

Length matters most: every extra character multiplies the number of guesses needed. Randomness matters next, because attackers try dictionary words, names, keyboard patterns and common substitutions such as @ for a long before random strings. Uniqueness matters too. Even a strong password becomes weak once it has leaked from one site and is reused on another.

How to improve a weak password

  1. Add length first: aim for at least 12 characters, ideally 16.
  2. Leave out personal details such as names, birthdays, pets and sports teams.
  3. Avoid keyboard runs such as qwerty or 12345 anywhere in the password.
  4. Never reuse it on another site.
  5. Store it in a password manager, so it does not need to be memorable.

Common uses

  • Checking whether an existing password is worth replacing.
  • Testing a passphrase before using it as a password manager's master password.
  • Showing family or staff how length changes password strength.
  • Comparing two possible passwords before choosing one.

Common problems and fixes

A long password still shows Weak. It probably starts with a very common word or sequence. Choose something that does not begin with a well-known password.

The bar barely moves. Add length first, then mix in other character types.

You want a strong password quickly. Use the Random Password Generator and store the result in a password manager.

Related tools

Frequently asked questions

Is it safe to type my password into this checker?

The password is analysed by code running in your browser and is never sent to our server, stored or logged. Even so, it is good practice not to type your most important passwords into any website. Test a similar example instead, or use the checker when creating a new password.

How is password strength calculated here?

Five tests each add one point: at least 8 characters, at least 12 characters, three or more character types, all four types, and estimated randomness of 60 bits or more. The total maps to six labels from Very Weak to Very Strong. Passwords starting with very common choices are capped at Weak.

Does the checker know if my password was leaked?

No. It looks only at the structure of the password and does not compare it with lists of breached passwords. A password can score Strong and still be unsafe if it has appeared in a breach. Never reuse a password that a service has told you was exposed.

Why does my long password only score Weak?

It probably starts with one of the most common passwords, such as password, 123456, qwerty, admin or welcome. Attackers try these first, so the checker caps the score at Weak, however many characters follow. Choose a password that does not start with a well-known word or sequence.

What is a good password length?

Aim for at least 12 characters, and 16 or more for important accounts. In this checker, reaching 12 characters earns a point on its own, and longer passwords also push up the randomness estimate. Length is the simplest way to make any password harder to guess.

Are passphrases strong passwords?

They can be. Four or more random, unrelated words make a long password that is easy to remember. The words must be chosen randomly, not taken from a quote, song or a phrase about you. Adding a number or symbol between words improves the score further.

Does changing letters to symbols make a password strong?

Only slightly. Swapping a for @ or o for 0 is so common that password-cracking tools try those changes automatically. A word with substitutions is still a word. Adding length and real randomness does far more than predictable substitutions, and is just as easy with a password manager.