How we estimate strength
Most strength meters count character types and reward P@ssw0rd1!. Real attackers do not brute force character by character, so this checker models what they actually do:
- Try a list of the most common passwords, including l33t variations (
p@ssw0rdis justpassword). - Try common words with digits or symbols added at the end.
- Discount keyboard walks (
qwerty,1qaz), alphabet runs (abcd), repeated characters and years. - Brute force what is left over the character sets you used.
Crack times are shown for an offline attack at 10 billion guesses a second (a stolen database with a fast hash and a few GPUs) and an online attack at 100 guesses a second.
How to make a weak password strong
- Make it longer instead of more complex. Add words, not symbols.
- Do not reuse it. A strong password reused on a hacked site is a weak password.
- Do not base it on your name, pet, team, birthday or the site name.
- Use the generator above and store it in a password manager.
- Turn on two-factor authentication wherever you can.
Frequently asked questions
Is it safe to type my real password here?
The check runs completely in your browser and makes no network requests. Even so, a good habit is to test a password that is similar to yours, not the exact one.
Why does my complex password score low?
Because it follows a pattern attackers try early, such as a dictionary word with a capital first letter and a number and symbol at the end. Those patterns are tried long before random brute force.
What is a bit of entropy?
Each bit doubles the number of guesses needed. 40 bits is about a trillion guesses, which a modern GPU does in minutes offline. 80 bits is a million times a trillion, which is out of reach.