Type a password
Analysis runs locally as you type. Prefer not to type a real one? Test the same pattern with a few characters changed.
Free tools · Passwords
How long would it survive?
Entropy, complexity rating and brute-force estimates across five attacker profiles — or build a policy, see its worth, and generate a sample. Computed on your device, never uploaded.
Test a password
Type it — it never leaves this page.
Analyzed locally as you type. Nothing is stored or uploaded; the field wipes after ten idle minutes.
Character classes
Crack times (brute-force averages)
Analyzes as Very strong (105.1 bits) — matches the estimate. Paste it straight into the field above to inspect it fully.
How it works
Three steps, all on your device.
The same keyspace arithmetic password researchers use, explained in plain rows instead of exponents.
Read the rating and table
Entropy and combinations describe the search space; the crack-time rows translate it into five attacker profiles, from throttled logins to GPU rigs.
Act on it
Breached or weak means change it now, ideally to a manager-generated random password or a multi-word passphrase. Reuse nothing important.
Questions
Measuring password strength, answered.
If you manage servers by hand, see the engineering services behind this tools series.
Is my password uploaded or stored anywhere?
No. Analysis runs entirely in your browser with plain arithmetic — the page makes no network requests, stores nothing, and wipes the field after ten idle minutes (sooner if you press Clear). You can verify this in your browser's developer tools or disconnect from the network after the page loads.
How is strength calculated?
Character-set size times length: each character class present (lowercase, uppercase, digits, symbols, other Unicode) widens the pool, and entropy in bits is length × log2(pool). The rating bands run from Very weak (under 28 bits) to Very strong (80 bits and up).
What do the attacker rows mean?
Average time to brute-force the keyspace at five rough, clearly labeled speeds: a rate-limited login (10 guesses/sec), a GPU rig against memory-hard Argon2 (1,000/sec) and bcrypt (10,000/sec), a laptop CPU against a stolen fast hash (10 million/sec), and a high-end GPU against one (100 billion/sec). They are 2025-era orders of magnitude for comparison, not benchmarks.
Why is my long password still rated very weak?
Because it appears in breach shortlists. Attackers try famous passwords first, so qwerty12345 falls instantly no matter its length. The math below still shows, but the rating stays at Very weak with a warning — change it.
How are emoji or non-Latin characters counted?
Anything outside printable ASCII counts toward a 100,000-symbol estimated pool. That is deliberately conservative: real input methods and site restrictions vary, so treat the resulting entropy as an upper bound, not a guarantee.
What should I use instead of passwords I invent?
A password manager generating long random passwords, or a multi-word passphrase of four or more random words for the few you must memorize. Either way: unique per site, with two-factor authentication where it matters.
How does the policy estimator differ from typing a password?
Typing analyzes one concrete password, quirks and all. The policy section answers the design question up front: given a length and character classes, how big is the search space and how long does it survive each attacker? Use it to set sane minimums before anyone picks a password.
Can I trust the generated sample?
It is drawn with your browser's secure generator, rejection-sampled for uniformity, guaranteed to cover every class you selected, and shuffled — then analyzed live so you can see the verdict match the estimate. Copy it straight into a password manager; never reuse it across sites.