Password Strength Checker: Free Online Test

A password strength checker tests how hard a password is to guess and tells you what to fix. Type or paste a password into this free tool and it rates it from Very Weak to Very Strong, estimates crack time, runs a six-point criteria checklist and lists specific recommendations as you type.

What Is Password Strength?

Password strength is a measure of how well a password resists guessing and brute-force attacks. Length, the mix of character types and how unpredictable the password is all affect the result. A strong password is long, varied and not built from words or patterns that attackers try first.

How strength is measured

Security people often describe strength in bits of entropy. Entropy depends on two things: how many characters you use, and how big the pool of possible characters is. The formula is length multiplied by the base-2 logarithm of the pool size. Lowercase letters add 26 to the pool, uppercase letters add 26, digits add 10 and symbols add 33 in this tool.

What is password complexity?

Password complexity is a set of rules that require certain character types, such as one uppercase letter, one number and one symbol. Complexity rules are a rough proxy for strength. A short password that meets every rule can still be weaker than a long one that skips a few. That is why this checker shows both a criteria checklist and a bit estimate.

How to Use the Password Strength Checker

You can check a password in a few seconds, and the results update with every keystroke. Follow these steps:

1. Click the field labeled Enter your password (it shows the hint "Type your password here") and type or paste the password you want to test.
2. Press the Toggle visibility button if you want to see the characters and catch typos. Press it again to hide them.
3. Watch the five-segment bar and the label beside it. The rating runs from Very Weak to Very Strong, with a score next to it.
4. Read the Crack time estimate, then the Password Criteria checklist to see which requirements you meet.
5. Follow the items under Recommendations, edit the password and watch the rating change.
6. Press Generate strong password if you want a random 16-character suggestion. It fills the field and shows its analysis right away.

Nothing needs to be submitted. There is no sign-in and no button to press for the analysis itself.

Worked Example: Three Passwords Compared

The easiest way to understand the results is to compare passwords side by side. The figures below follow the same entropy formula the tool uses.

dragon is a well-known password. The checker flags it with the message "This is a commonly used password. Choose something unique." and asks for more characters, since it is under 8.

mountainbike has 12 lowercase letters, so the pool is 26 and the math is 12 × log2(26), which is about 12 × 4.70 = 56.4 bits. It passes the length checks, but the checklist shows missing uppercase letters, numbers and special characters. Remember that 56.4 bits assumes random letters. Two ordinary words are far easier to guess than random ones.

Mb7#kLq2!vXp9&Rt uses all four character types, so the pool is 95 and the math is 16 × log2(95), about 16 × 6.57 = 105.1 bits. Every checklist item is ticked and the tool reports that the password meets all strength criteria. That is the kind of result a password manager should store for you.

How Do You Read the Results?

Each part of the results panel answers a different question, so read them together instead of focusing on the bar alone.

Rating, bar and score

The five bar segments and the label give you the quick verdict: Very Weak, Weak, Medium, Strong or Very Strong. Aim for Strong or Very Strong for any account that matters. If the label is Medium, treat it as a prompt to lengthen the password, not as a pass.

Crack time

Crack time is an estimate of how long a brute-force attack would need. Use it for comparison, not as a promise. A password that shows seconds or minutes needs replacing immediately. One that shows years or longer is in good shape, as long as it is not based on personal details.

Password criteria and details

The checklist covers six items: 8 or more characters, an uppercase letter, a lowercase letter, a number, a special character and 12 or more characters. The details panel adds four numbers: length, character types out of 4, a random-model upper bound in bits and the count of unique characters. The bit figure is labeled an upper bound because it assumes every character was chosen at random.

Recommendations and the fix for each

• Commonly used password: replace it completely. Adding a digit to a known password does not help much.
• Add more characters: the tool asks for at least 8, then suggests 12 or more for extra protection.
• Add uppercase, lowercase, numbers or symbols: each one widens the character pool.
• Avoid keyboard sequences: strings like qwerty, abc or 123 are among the first things attackers try.
• Avoid repeating the same character: aaa or 111 adds length without adding real unpredictability.
• Use more unique characters: if many characters repeat, the checker warns you. Mix them up.

Who Should Use a Password Strength Checker?

Anyone who creates or manages logins can get a quick sanity check from this tool. These are the situations where it helps most:

• Everyday users who want to know what their strength looks like before setting an email, banking or social media password.
• Website owners and admins who need a clear example of strength guidance to share with their team or customers.
• Students and trainers teaching why length beats clever substitutions, using the live bar and bit counts as a demonstration.
• Anyone replacing an old password who wants to compare a new idea with the old one before committing.

If you only need a strong random password and do not have one in mind, the password generator lets you customize length and character options. The built-in Generate strong password button is a quicker option when you just want a 16-character suggestion.

Best Practices and Common Mistakes

The most reliable rule is simple: longer and more random wins. Beyond that, a few habits make a measurable difference.

• Go past 12 characters. The checklist treats 12 as the extra-strength mark. For important accounts, 16 or more is a better target.
• Use a unique password for every account. A strong password reused across sites is only as safe as the weakest site.
• Skip personal details. Names, birthdays, pets and favorite teams are easy to guess, and the checker cannot know they are yours.
• Do not rely on substitutions. Swapping a for @ or o for 0 in a common word, such as p@ssw0rd, is a pattern attackers already expect.
• Try a passphrase. Several unrelated random words joined together can be long and easier to remember. Add a number or symbol to satisfy sites that require them.
• Store passwords in a password manager. A manager lets you use long random strings you never need to memorize.

Troubleshooting a surprising result

If a long password scores lower than you expected, look at the unique-character count and the recommendations. A string like aaaaaaaaaaaa has length but little variety, and the checker will point out the repetition. If a short password with every character type scores only Medium, the fix is length: add four or more characters.

If the analysis panel disappears, the field is empty. Type or paste again and it returns.

Limitations and Accuracy Notes

This checker is a guide, not a guarantee. It looks at length, character variety, repeated characters, keyboard and alphabet sequences and a list of widely used passwords. It does not know whether your password has appeared in a past data breach, and it cannot recognize personal information or every dictionary word.

The crack time and bit figures also assume a random choice of characters, so a memorable phrase will usually be weaker in practice than its number suggests. Treat the numbers as a comparison between candidates, and use two-factor authentication wherever it is offered.

If you build or run a site that stores user passwords, strength is only half the picture. Passwords should be hashed before storage, and the bcrypt hash generator and password encryptor let you see how that looks for sample values. For other protective checks, browse the full security and encryption tools collection.

Test a password in the field above, follow the recommendations until the bar reaches Strong or Very Strong, and then save the result in a password manager. A few seconds of checking now can save you from a compromised account later.