RunToolRunPassword Strength Checker
Check your password strength.
How to Check Password Strength
Type a password
Enter the password you want to evaluate — it never leaves your device.
Analysis runs locally
Length, character variety and common patterns are scored in your browser.
Read the verdict and tips
See the strength rating and what specifically would improve it.
It estimates guesses, not character combinations
Naive strength meters count character types and length, which is why they rate 'P@ssw0rd1' highly. This checker uses a different approach: it estimates how many guesses an attacker would actually need, by recognising the patterns real attackers exploit.
It matches against common passwords, dictionary words, names, dates, keyboard runs like 'qwerty', repeated characters and the predictable substitutions people use — @ for a, 0 for o, 3 for e. A password built from those pieces is scored as what it is: a small number of guesses away.
Why substitution does not help
Replacing letters with lookalike symbols feels clever because it makes a password look complicated. Cracking tools have applied exactly those substitutions to every dictionary word for decades, so the transformation adds almost nothing to the guessing effort.
The same applies to appending a number and an exclamation mark, or capitalising the first letter. These are the most predictable things a person does when told to make a password 'complex', which is precisely why they are the first things tried.
Length is the variable that actually matters
The number of possible passwords grows exponentially with length and only linearly with the size of the character set. That asymmetry means a long passphrase of ordinary words beats a short string of symbols, provided the words are chosen randomly rather than forming a phrase someone might say.
Four random words are strong because they were picked at random. A quotation, a song lyric or a phrase about you is not, however long it is — an attacker's dictionary contains phrases as well as words.
What a good score does not protect you from
Strength is irrelevant if the password has been reused somewhere that was breached. Attackers do not usually guess; they take a password from one leaked database and try it everywhere else with the same email address. A unique password per account is worth more than a strong shared one.
It is equally irrelevant against a convincing phishing page, where you type the password in yourself. Two-factor authentication is what limits the damage in both scenarios, and it does more for account safety than any amount of password tuning.
Why checking locally is the whole point
Typing a real password into a website is normally a bad idea, since you have no way of knowing what happens to it. Here the analysis runs entirely in your browser: the password is never sent anywhere, never logged, and never leaves your device.
That said, the safest habit is not to test passwords you actually use. Test the pattern instead — if the type of password you build scores badly, the answer is a password manager generating unique random passwords, not a cleverer pattern.