Free Password Strength Checker
See how long a password could hold up against real guessing methods, and exactly what makes it weak.
Checked in your browser. Never sent or saved.
How to read your result
- Very weakOn common-password lists, very short, or a simple pattern.Replace it now, on every account that uses it.
- WeakA stolen password file could reveal it quickly.Replace it with a longer, generated password.
- FairResists casual guessing, but not a determined offline attack.Fine only with a second sign-in step. Longer is better.
- StrongHard to guess by any common method we model.Keep it unique to this one account.
- Very strongAt least 15 characters, with no predictable pattern we could find.Store it in a password manager, and don't reuse it.
Why length beats a messy short password
Compare these patterns, then try them in the checker. The results use the same scoring as the tool above.
| Example | Pattern | Result | Fast offline attack | Try |
|---|---|---|---|---|
| P@ss1! | Short, with symbol swaps | Very weak | Instantly | |
| Password123! | Common word plus a predictable ending | Very weak | Instantly | |
| MyDogRex2015! | Personal details and a year | Weak | Instantly | |
| zqjxkvbwpfgh | Random, but only 12 letters | Fair | 4 hours | |
| correcthorsebatterystaple | Four common words | Fair | 15 minutes | |
| violet-anchor-pepper-mango-tram | Five unrelated words | Very strong | Centuries or more |
What actually makes a password strong
Make it long
Aim for 16 characters or more. NIST's guideline requires at least 15 for a password used on its own, and tells services not to force mixes of character types.
Make it unpredictable
Avoid names, dates, and common swaps. Random words work well when there are five or more and you didn't choose them yourself.
Use it once
Reuse is what turns one breach into many. If you tested a password you use elsewhere, change it everywhere.
Don't invent passwords. Generate them.
Create a random one, then keep it in a password manager so you never need to memorize it.
What this checker can't tell you
- Whether it has leaked. We don't look it up anywhere. To check, use the Have I Been Pwned password search.
- Whether it's personal to you. It doesn't know your pet's name or birthday, so a password can score well and still be easy for someone who knows you.
- Whether you reuse it. A strong password used on many sites is still risky.
How the estimate works
- It looks for common passwords, a built-in list of common words and names, keyboard runs, repeats, dates, and character swaps.
- It estimates how many guesses each part would take, then converts that to time at the two speeds shown.
- Passwords under 15 characters can't reach “Very strong.” Our word lists are small, so some weak passwords will score too well.
Password strength questions
Is it safe to type my password here?
The check runs in your browser, and the password is not sent anywhere or saved. This page also tells your browser to block its scripts from opening network connections. Even so, the safest habit is never to type a password you actively use into any online tool. Test a similar length and pattern instead.
How long should my password be?
We suggest at least 16 characters. NIST's current guideline sets 15 as the minimum for a password used on its own. A random passphrase of five or more unrelated words is a good way to get there, and it's easier to remember than a short string full of symbols.
Do symbols and capitals still matter?
They help a little when they're random. They help far less when they follow a habit, like a capital first letter and an exclamation mark at the end. Added length usually does more.
Why does another checker give a different result?
Each checker uses its own rules and word lists. Many only count character types, so they rate Password123! as strong. Ours also looks for common words and patterns, but every result is still an estimate.
What should I do if my password is weak?
Change it on that account, and on any other account using it. Use a generated password stored in a password manager, and turn on a second sign-in step where you can.