Password Strength Checker

It adds up how hard each part of the password is to guess, treating common words, sequences and years as cheap, and the rest by character variety. It then divides by an assumed 10 billion guesses per second, a harsh offline attack, to get the crack time.

Yes, provided it runs client-side. This checker analyzes everything locally in your browser using JavaScript, so your password is never sent anywhere, which you can verify by checking that the tool works with your network disconnected.

Each added character multiplies the total possible combinations exponentially, while adding symbol variety only multiplies by a smaller factor. A 20-character passphrase of ordinary words often outscores a short, symbol-dense password.

Keyboard runs like qwerty, counting sequences like 12345, repeated characters, years, and common words with letter swaps such as p@ssw0rd all get flagged, because attackers check these patterns first. Our word list is short, so rarer words may slip through.

Immediately after any breach notification involving an account you use. Outside of that, a long, unique, generator-created password doesn't need routine rotation, frequent forced changes often just push people toward weaker, more memorable passwords.

Length matters more than complexity. A 16-character password of random words takes dramatically longer to brute-force than an 8-character password stuffed with symbols, because every added character multiplies the number of possible combinations an attacker has to try.