Password Strength Checker
Check how strong your password is with a private, in-browser entropy estimate. See strength, entropy bits, and tips to make it harder to crack. Nothing is sent.
Updated 2026-06-14 · Free · No sign-up · Runs privately in your browser
Details & tips
How the Password Strength Checker Works
This tool estimates how hard your password would be to guess and rates it from very weak to very strong. Type a password and it instantly shows the strength band, the estimated entropy in bits, the length, and practical tips to improve it.
The check is completely private — it runs in your browser with JavaScript and your password is never sent anywhere.
The Formula
Password strength is measured as entropy, the number of bits of unpredictability:
Entropy (bits) = length × log₂(character pool size)
The character pool grows with each class of characters you use:
lowercase +26, uppercase +26, digits +10, symbols +33
So a 12-character password using all four classes draws from a pool of 95 symbols, giving 12 × log₂(95) ≈ 78.8 bits.
Worked Example
For the password Tr0ub4dor&3 (11 characters, all four classes):
- Pool size = 26 + 26 + 10 + 33 = 95
- Entropy = 11 × log₂(95) ≈ 11 × 6.57 ≈ 72.3 bits
- That lands in the strong band
Note that if a password contains a common word or a leaked-password pattern, the real-world strength is much lower than the raw bits, so the checker flags it.
Entropy Strength Bands
| Entropy (bits) | Rating |
|---|---|
| Under 28 | Very weak |
| 28-35 | Weak |
| 36-59 | Fair |
| 60-127 | Strong |
| 128+ | Very strong |
Tips for a Stronger Password
- Go long. Length adds more strength than any single symbol. Aim for 12-16+ characters.
- Use a passphrase. Four or more random, unrelated words are easy to remember and high in entropy.
- Mix character types. Combine upper and lower case, digits and symbols to widen the pool.
- Stay unique. Never reuse a password across sites; a leak on one site exposes the rest.
- Use a password manager to generate and store long random passwords you do not need to memorise.
Frequently asked questions
How is password strength measured?+
Strength is estimated as entropy in bits, calculated as the password length multiplied by the base-2 logarithm of the character pool size. More characters and a wider mix of letters, digits and symbols mean more bits and a harder-to-crack password.
Is my password sent anywhere when I check it?+
No. The check runs entirely in your browser using JavaScript. Your password is never transmitted, logged, or stored. You can disconnect from the internet and the checker still works.
How many bits of entropy is a strong password?+
Roughly: under 28 bits is very weak, 36-60 bits is fair, 60-128 bits is strong, and over 128 bits is very strong. Aim for at least 60-80 bits, which a random 12-16 character password with mixed classes comfortably exceeds.
Does length or complexity matter more?+
Length usually wins. Each extra character multiplies the number of possible passwords, so a long passphrase often beats a short password full of symbols. Combining good length with a mix of character types is best.
Why is a common word rated weak even if it is long?+
Entropy math assumes random characters. Real attackers try dictionary words, names and known leaked passwords first, so a recognisable word is guessed far faster than its raw entropy suggests. The checker flags common patterns and downgrades them.