Security Tool
Password Strength Checker
Type a password to see how strong it is, how long it would take to crack and what would make it stronger. The check runs in your browser, so the password never leaves your device.
Analyzed locally. Nothing sent to servers.
Enter a password to begin analysis
How It Works
How This Password Checker Scores You
Length
Passes at 8 characters and again at 12. Length adds more strength than any other single change.
Character mix
Lowercase, uppercase, numbers and symbols each widen the set of characters an attacker has to try.
Common passwords
Passwords like 123456, qwerty and letmein are on every attacker's first list, so they fail whatever else they contain.
Entropy and time to crack
Entropy, in bits, counts the guesses needed to try every combination. The time to crack turns that into time at 10 billion guesses a second.
Questions
How Secure Is My Password?
Is it safe to type my password into a password strength checker?
On this page, yes: the check runs in your browser and the password is never sent anywhere. Be careful with checkers that send what you type to a server. If you are unsure about any site, test a password with the same length and mix of characters instead of the real one.
How long would it take to crack my password?
The time shown assumes an attacker who has stolen a scrambled copy of the password and tries 10 billion guesses a second on their own hardware, trying every combination of the characters you used. A common password or a dictionary word falls in seconds whatever its length, because attackers try those first.
What makes a password strong?
Length first, then randomness. A strong password is at least 12 characters (16 is better), mixes lowercase, uppercase, numbers and symbols, and contains no names, dates, keyboard runs like qwerty or common words with letters swapped for numbers. Most important of all, it is used for one account only.
How long should a password be?
At least 12 characters for everyday accounts and 16 or more for email, banking and anything that can reset your other passwords. Each extra random character multiplies the number of guesses an attacker needs, so length beats clever substitutions.
Is a passphrase stronger than a password?
A passphrase of four or more random, unrelated words is long, hard to guess and easy to remember, which makes it a good choice for the few passwords you have to type yourself. A famous quote or song lyric is not random and is easy to guess.
Should I change my passwords regularly?
Change a password when the service has been breached or you think someone else knows it. Forced changes every few months tend to produce weaker, predictable passwords. A unique, strong password per account and two-factor sign-in protect you more.
Need a new one? The strong password generator makes a random password in your browser.
Encrypt Your Connection
Strong passwords protect accounts. A VPN protects your entire connection.