Runs in your browser. Your files and text never leave your device - nothing is uploaded.
Test Your Password Strength Online
The Tools Kit’s free Password Strength Checker tells you how strong a password is as you type. It scores the password against eight checks covering length, character variety, repeated characters and very common passwords, rates it from Very Weak to Strong, and estimates its entropy in bits so you can see how large the search space really is.
The whole check runs in your browser. The password is never sent to a server, saved or logged, so you can test a password you actually use. If the result is disappointing, the password generator creates a random replacement from 6 to 64 characters long.
How to Check How Strong Your Password Is
- 1
Type or paste a password
Enter the password in the field. It is masked by default; click Show if you want to read what you typed, and Hide to mask it again.
- 2
Read the rating and entropy
As you type, a colored bar and a label of Very Weak, Weak, Good or Strong appear, along with an estimate of the password’s entropy in bits.
- 3
Check what is missing
The checklist marks each requirement as passed or failed: 12 or more characters, uppercase, lowercase, numbers, symbols, no repeated character runs, and not a common password.
- 4
Improve it and test again
Make the password longer or fix the failed items and the rating updates instantly. Nothing is sent anywhere, so you can try as many variations as you like.
No sign-up is needed and there is no limit on how many passwords you test.
How the Strength Score Works
The checker awards one point for each of eight checks: at least 8 characters, at least 12 characters, a lowercase letter, an uppercase letter, a number, a symbol, no character repeated three or more times in a row, and not starting with a very common password (password, 123456, qwerty, letmein, admin, welcome or abc123). The total sets the label: 0 to 2 points is Very Weak, 3 to 4 is Weak, 5 to 6 is Good, and 7 to 8 is Strong. The bar fills in proportion to the score.
The checklist under the bar shows seven of those checks by name; the 8-character minimum still counts toward the score but has no row of its own. Here is how some sample passwords come out:
| Password | Score | Rating | Entropy (bits) | Why |
|---|---|---|---|---|
sunshine | 4 / 8 | Weak | 38 | Lowercase only, under 12 characters |
Sunshine1 | 6 / 8 | Good | 54 | No symbol, under 12 characters |
P@ssw0rd | 7 / 8 | Strong | 52 | Only misses 12+ characters, yet guessable |
Password123! | 7 / 8 | Strong | 79 | Fails the common password check |
aaaaaaaaaaaaaaaa | 4 / 8 | Weak | 75 | Repeated run, one character type |
kX9#mQ2$vL7p | 8 / 8 | Strong | 79 | Passes every check |
The table also shows the limits of any rule-based meter. P@ssw0rd and Password123! both rate Strong because they tick most boxes, but they are built from the most guessed word on the internet and would fall to a dictionary attack in moments. Treat a Strong rating as a minimum bar, and prefer passwords you did not invent yourself.
Password Entropy Explained
Entropy measures how many guesses a brute-force attack needs, in bits: entropy = length × log2(pool size). The checker builds the pool from the character types present, adding 26 for lowercase, 26 for uppercase, 10 for digits and 32 for symbols, for a maximum of 94. Each extra bit doubles the work.
Take Sunshine1: lowercase, uppercase and digits give a 62-character pool, and log2(62) is about 5.95, so 9 characters × 5.95 ≈ 54 bits. Assuming an offline attacker making 10 billion guesses per second against a fast hash, finding a random 54-bit password takes about 10 days on average. sunshine at 38 bits would take about 14 seconds, while a random 12-character password using all four types (79 bits) would take nearly a million years.
The catch is that the formula assumes every character was picked at random. It does not discount words, names, keyboard patterns or repeats, which is why aaaaaaaaaaaaaaaa still shows 75 bits. For a password you made up, read the entropy as an upper limit. A password that came out of a random generator is the only kind where the number is a fair estimate.
How long a real attack takes also depends on how the site stores your password. Compare a fast algorithm in the SHA-256 hash generator with the deliberately slow, salted bcrypt generator: bcrypt cuts the number of guesses per second by many orders of magnitude. If you are not sure what kind of hash you are looking at, the hash identifier suggests likely algorithms from its length and prefix.
What Makes a Password Strong?
Length matters most. Going from a 62-character pool to the full 94 adds only about 0.6 bits per character, so adding symbols to a 12-character password gains about 7 bits, while four extra letters or digits gain about 24. Aim for at least 12 characters, and 16 or more for email, banking and your password manager.
Unpredictability matters next. A passphrase of four or more randomly chosen words is long and easy to type; the random word generator can help you brainstorm, though for an important passphrase you should pick words with a truly random method such as dice. Finally, use a different password for every account and turn on two-factor authentication where it is offered. The TOTP code generator shows how the six-digit codes from authenticator apps are produced from a shared secret.
Common uses
- Checking whether a password meets a 12-character, mixed-case, number-and-symbol policy
- Seeing which requirement made a sign-up form reject your password
- Comparing two candidate passwords before saving one to your password manager
- Showing a colleague or family member why length beats swapping letters for symbols
- Reviewing a shared Wi-Fi or team password that has been in use for years
For hashing, encoding and network utilities, browse all security tools.
Password security terms explained
| Term | What it means here |
|---|---|
| Entropy (bits) | Length multiplied by log2 of the character pool. Each extra bit doubles the number of guesses a brute-force attack needs |
| Character pool | The characters a password could draw from; this checker counts 26 lowercase, 26 uppercase, 10 digits and 32 symbols, up to 94 |
| Brute force | Trying every possible combination in turn; entropy estimates how long this would take |
| Dictionary attack | Guessing real words, names, leaked passwords and predictable substitutions such as @ for a, long before trying random strings |
| Credential stuffing | Replaying username and password pairs leaked from one site against other sites, which is why reuse is dangerous |
| Password hash | The one-way fingerprint a site stores instead of your password; slow, salted algorithms such as bcrypt make guessing far more expensive |
Frequently Asked Questions
The check runs entirely in your browser. The password is analyzed by JavaScript on the page and is never sent to a server, stored or logged, and it is gone when you close or reload the tab. If you prefer, test a password with the same structure instead of the exact one you use.
It awards one point for each of eight checks: at least 8 characters, at least 12 characters, a lowercase letter, an uppercase letter, a number, a symbol, no character repeated three or more times in a row, and not starting with a very common password. Zero to two points is Very Weak, three or four is Weak, five or six is Good, and seven or eight is Strong.
The checker builds a character pool from the types you used: 26 for lowercase, 26 for uppercase, 10 for digits and 32 for symbols. Entropy is the length multiplied by log2 of that pool, rounded to a whole number. A 12-character password using all four types has a 94-character pool, so 12 × 6.55 gives about 79 bits.
For a truly random password, around 60 bits resists casual attacks, 80 bits or more is a good target for email, banking and password-manager accounts, and 100 bits or more is beyond any realistic brute-force attack. Those numbers only hold if the characters were chosen randomly rather than built from words or patterns.
Because it ticks the boxes: it has 8 characters and uses all four character types, and it does not begin with the word password, so it scores 7 of 8. Real cracking tools try common words with predictable substitutions very early, so a password like this is weak in practice. Treat the rating as a checklist, not a guarantee.
The check fails if the password starts with password, 123456, qwerty, letmein, admin, welcome or abc123, ignoring case. It is a short built-in list, not a database of leaked passwords, so a password can pass this check and still be widely known.
No. It does not look the password up in any breach database. If you suspect a password has been exposed, change it on every site where you used it and switch to a unique, randomly generated password for each account.
Any character that is not an English letter or a digit, including punctuation, spaces and accented or non-Latin letters. Whatever symbols you use, the entropy estimate adds 32 to the pool, which roughly matches the punctuation on a US keyboard.
Entropy grows in step with length but only with the logarithm of the pool. Adding symbols to a 12-character password of letters and digits raises the pool from 62 to 94 and adds about 7 bits, while adding four more letters or digits adds about 24 bits.
Three or more of the same character in a row, such as aaa or 111. Two in a row is fine. Runs like this are among the first things guessing tools try, so they add little real strength.
Often, yes. correcthorsebatterystaple scores only Good here because it lacks uppercase, numbers and symbols, but four or more truly random words are hard to guess. The 118-bit entropy figure overstates it, though: an attacker guessing whole words faces closer to 44 bits for four words picked from a 2,048-word list.
Reviewed by Raja Jahangir · Last reviewed: October 7, 2026
How strong is my password?
Password strength combines length, character variety, and predictability. Entropy is length multiplied by log2 of the character pool: a 12-character password mixing upper case, lower case, and digits draws from 62 symbols, about 71 bits. Checks also flag repeated character runs and common passwords like qwerty. Checking runs entirely in the browser, so nothing is sent anywhere.
How many bits of entropy should a password have?
Aim for at least 60 bits of entropy for everyday accounts and 80 or more for anything guarding money or email. Each extra character adds more than an extra symbol type does: going from 12 to 16 lower-case-plus-digits characters adds roughly 21 bits, while adding symbols to a 12-character password of letters and digits adds only about 7.