How it works
This password strength checker estimates entropy in bits from the character set and length, converts that to an approximate time to crack at 10 billion guesses per second, and flags concrete problems: too short, missing character types, common words, sequential runs, heavy repetition.
The password you type is analysed by JavaScript in your browser and is never transmitted or stored — you can disconnect from the internet and it still works. Treat the crack-time figure as a relative guide, not a promise.
What the checker can't see
This is a heuristic, not a verdict. It assumes every character was chosen at random, which a human-made password almost never is — Summer2024! scores far higher here than an attacker would rate it. It also has no way to know whether the password is reused, already in a breach, or written on a sticky note.
Use it as a relative gauge while building a password, then confirm with the leak checker and keep the result in a password manager. A number here is no substitute for a unique password per account and two-factor authentication.
Generated a strong password? You need somewhere safe to keep it →
Related terms: Entropy · Brute force · Dictionary attack · Key stretching