Password Strength Checker and Generator
Test how long a password would take to crack at ten billion guesses a second, see which character classes it contains, and generate replacements of any length from the character sets you choose.
What Each Number Means
Typing into the field runs a fixed set of checks on every keystroke. The page reports the length, the size of the character pool, an entropy figure in bits, an estimated cracking time and a score out of one hundred, alongside flags for common passwords, sequential runs and repeated characters.
- The pool is built by adding 26 for lowercase, 26 for uppercase, 10 for digits and 33 for anything that is not a letter or a number. A password with all four classes therefore has a pool of 95.
- Entropy is the length multiplied by the base-two logarithm of the pool, rounded to a whole number. It rises with both length and variety, but length moves it further because it multiplies rather than adds.
- Crack time is the pool raised to the power of the length, divided by ten billion guesses per second. That is the time to exhaust the whole space, not the average time to reach the right answer.
- The score starts at four points per character, capped at forty, then adds ten for each character class present, ten more for reaching eight characters and five more for twelve. Being a known common password caps it at twenty, while a sequential or triple-repeated run subtracts ten.
Testing and Replacing a Password
- Type or paste the password you want to assess. The analysis updates as you type, so there is nothing to submit.
- Read the four flags first: common password, sequential pattern, repeated characters, and which of the four character classes are present.
- Look at the score band rather than the raw number. Under thirty is Very Weak, under fifty Weak, under seventy Fair, under ninety Good, and ninety or above is Strong.
- If you would rather start fresh, set a length and a count, tick the character sets you want, and press Generate. The output appears as one or more ready-to-copy strings.
- Use the Show or Hide control if you need to read the password you are testing on screen, and remember the field is plainly visible unless you toggle it.
Three Passwords, Measured
The figures below are exactly what the page prints for each input, using its own formulas and rounding.
- The word password1 gives length nine, pool 36, entropy 47 bits, a crack time of about three hours and a score of 20, labelled Very Weak. Its score would have been higher, but it is on the built-in common list, and that check caps the result at twenty.
- The string abcdefgh gives length eight, pool 26, entropy 38 bits, a crack time of roughly twenty-one seconds and a score of 42, labelled Weak. Even though it never appears on the common list, the sequential run of letters costs it ten points.
- A mixed string such as Tr0ub4dor&3 gives length eleven, pool 95, entropy 72 bits, a crack time the page renders as centuries, and a score of 90, labelled Strong.
- A long passphrase of several lower-case words reaches a very high entropy figure because of its length, yet it only adds points for the lower-case class, so its score can still land in Good rather than Strong.
Judging a Password by Different Measures
| Alternative | Notes |
|---|
| Brute-force space | Pool size to the power of length assumes an attacker tries every combination. It overstates weak passwords that use dictionary words, because real attacks guess those first rather than sweeping the full space. |
| Pattern and dictionary checks | Looking for common passwords, keyboard walks and repeated characters catches the passwords people actually pick. It cannot catch a password that is rare but still predictable to someone who knows you. |
| Length above all | Many modern guidelines lead with length, on the reasoning that a long passphrase resists guessing better than a short jumble. The trade-off is that length alone says nothing about whether the words are guessable. |
| Entropy in bits | Bits are a compact way to compare two passwords, but they inherit the assumptions of the pool model. A familiar quotation can have high theoretical entropy and still fall quickly to a phrase-based attack. |
Your Password Never Leaves the Page
The analysis and the generator both run as local JavaScript. This matters more here than on most tools, because a password is exactly the kind of value you should not paste into a random website.
- Nothing is transmitted. The page makes no request that carries your password; every check runs in the browser tab you are looking at.
- There is no logging step and no analytics call attached to the input field. The value lives in the text box and nowhere else.
- The generator builds its output with the browser's own random number generator, entirely on your device.
- The only stored value is your theme preference, kept in local storage so it survives a reload. The password itself is not stored.
- Because the analysis field is not masked by default, be careful on a shared screen; the Show and Hide button controls masking but does not change the fact that the value is held in memory.
Password Questions
Is a high entropy score enough on its own?
No. Entropy here is a property of length and character pool, not of how guessable the password is. A long sequence that an attacker would try early can still score well on entropy while falling quickly in practice. Read the entropy number together with the common-password and sequential-pattern flags, which are there to catch exactly that gap.
What does a score of one hundred mean?
It means the password hit every positive rule: enough length, all four character classes, no common-list match, no sequential run and no triple-repeated character. It is a ceiling for the scoring rules rather than a guarantee of safety. A password can reach one hundred and still be weak if it is, say, a well-known quotation that happens not to trigger any of the pattern checks.
Why does adding a symbol help so much?
Because the pool jumps by 33, which raises the entropy for every character in the string, not just the one symbol you added. It also adds a flat ten points to the score. The effect is real but it compounds with length: a single symbol on a six-character password helps far less than the same symbol on a sixteen-character one.
Are generated passwords properly random?
They are built from the browser's random source, and each selected character set is guaranteed to appear at least once before the whole string is shuffled. That guarantee slightly biases the distribution compared with pure random selection, which is a deliberate trade so the output never accidentally omits a class you asked for.
Last verified: October 3, 2026
Launch Password Strength Checker
All Tools · All Tools · About · How We Test · Contact · Privacy
Maintained by Huang Bin · Last updated October 3, 2026