Password Strength Checker
How strong is your password — really? Local strength scoring plus a private breach check.
This checker scores passwords the way attackers crack them: it estimates entropy (how unpredictable the password is, in bits) from its length and character mix, then penalises the patterns cracking tools try first — dictionary words, keyboard walks, repeated characters and the world’s most common passwords. The crack-time estimate assumes an offline attack at ten billion guesses a second, the scenario that applies when a site’s password database leaks.
Uses k-anonymity: your password is hashed on this device and only the first 5 characters of the hash are sent to the Have I Been Pwned API. The password itself — and the full hash — never leave your browser, and the service cannot work out what you checked.
How to use
- Type or paste the password into the box — analysis is instant and fully local; the password is never sent anywhere.
- Read the strength label and the fix-it list. Length matters most: a long passphrase beats a short clever password.
- Optionally press the breach-check button to see whether that exact password has appeared in known data breaches — using a privacy-preserving hash-prefix lookup.
About this tool
The optional breach check uses the Have I Been Pwned database of billions of leaked passwords, queried with k-anonymity: your browser hashes the password with SHA-1, sends only the first five characters of that hash, and compares the rest locally against the matches returned. The service learns nothing useful about your password — this is the same technique built into several major password managers.
A strong score is not a free pass: the defence that saves the most accounts is uniqueness. One breach should never unlock your email, your bank and your shopping accounts at once — use a different password for each, ideally from a password manager or our password generator.
Frequently asked questions
Is it safe to type my real password here?
The analysis runs 100% in your browser and the password is never transmitted or stored. The breach check sends only five characters of a hash — not the password, not the full hash. That said, good practice is to test a similar password rather than one you actively use for banking.
What makes a password strong?
Length first (12–16+ characters), unpredictability second. A passphrase of four or five random words is both stronger and easier to remember than something like "P@ssw0rd!" — which cracking dictionaries already contain.
What does "bits of entropy" mean?
Entropy measures how many guesses an attacker needs, on a logarithmic scale: every extra bit doubles the work. 40 bits falls quickly to a determined offline attack; 80+ bits is effectively out of reach.
The breach check says my password appeared millions of times. Now what?
Stop using it everywhere, starting with your email account (password resets flow through email). Replace it with a unique generated password and turn on two-factor authentication where offered.
More free tools
Phone Number Checker
Validate any phone number: country, line type and the correct international format.
IBAN Validator
Check an IBAN for typos before you send money — mod-97 validation and full structure breakdown.
Credit Card Validator
Check a card number’s format: Luhn checksum and card brand, right in your browser.
QR Code Generator
Turn any link or text into a scannable QR code in seconds.
Word Counter
Count words, characters, sentences and reading time as you type.
Percentage Calculator
Work out percentages, increases and discounts in one click.