Password Strength Checker
Check password strength with entropy analysis, character variety checks, and common password detection.
When a password strength checker is the right tool
Use this page for a quick, local look at length, character classes, a rough entropy figure, and whether the whole string is one of twenty common passwords. Type in the box; the meter, stats, and checklist update as you type. It is not a substitute for a generator or a breach database. To create a new password, use Password Generator.
Use cases
Checking a candidate before you use it
Type the candidate (the field is masked until you show it). A length-14 mix of upper, lower, digits, and a symbol typically lands on Very Strong here. A lowercase word of length 8 that is not in the list is only Weak. password and Password are both Very Weak because they hit the common list.
Reading the checklist and the warning
Green ticks and red crosses correspond to the seven rules above. Length 16 can still add a score point even though it is not a separate row. If the value is in the common list, a red banner also appears under the checklist.
Treating entropy as an estimate only
The bits figure grows with length and with how many character classes are present. It does not notice that xxxxxxxxxxxxxxxx is a repeated letter, and it assumes every symbol comes from a 32-character set.
How the analysis works
Classes are detected with simple regular expressions: [A-Z], [a-z], [0-9], and [^A-Za-z0-9]. The common-password check is toLowerCase() against the fixed set. Score, strength label, and entropy are then computed as described in the FAQ. An empty field hides the results entirely.
password Very Weak (common list, score 0)
abcdefgh Weak (length 8, lowercase only, score 2)
Abcdefghijkl Fair (length 12, upper+lower, score 4)
Abcdef1! Strong (length 8, all four classes, score 5)
Abcdefghijkl1! Very Strong (length 14, all classes, score 6)
password1 Fair (not an exact list match, score 3)password1 escapes the exact-list check and is only Fair. That is expected: this is not a pattern or dictionary attack.
What this tool does not do
It does not query a leak database, detect keyboard walks or l33t substitutions, or use zxcvbn. It does not store or upload the password. For a digest of some text, use Hash Generator.
How to use Password Strength Checker
- Type a password in the box. Use the eye button if you want to see the characters.
- Read the strength label and bars, then the length and entropy figures.
- Scan the checklist, and the common-password warning if it appears.
Frequently asked questions
How is the strength score calculated?
It is a simple checklist score, not zxcvbn and not a breach check. You get one point each for length at least 8, 12, and 16, plus one point each if the string contains an uppercase letter, a lowercase letter, a digit, and a non-alphanumeric character. If the password (compared case-insensitively) is in the built-in common list, three points are subtracted, with a floor of 0. Totals: 0–1 Very Weak, 2 Weak, 3–4 Fair, 5 Strong, 6–7 Very Strong. Those labels are fixed English text. The meter has five bars.
What counts as a common password?
An exact match, ignoring case, against a short built-in list of 20 strings: password, 123456, 12345678, qwerty, abc123, monkey, master, letmein, dragon, 111111, baseball, iloveyou, trustno1, sunshine, princess, admin, shadow, superman, michael, and football. password1 is not treated as common. The checklist item “Not a common password” fails only on those exact values, and a red warning appears: “This password appears in common password lists. Choose a different one.”
How is entropy estimated?
The tool assumes a character-set size of 26 for lowercase, 26 for uppercase, 10 for digits, and 32 for any non-alphanumeric character, then computes log2(charset size) × length, shown to one decimal place in bits. Repeated characters such as xxxxxxxxxxxxxxxx still get the full lowercase-only estimate (75.2 bits at length 16). Spaces and punctuation both count as the “symbol” class. This is not Shannon entropy of the actual string, and it is not a crack-time estimate.
Which checks appear in the list?
Seven rows: at least 8 characters, at least 12 characters, uppercase, lowercase, digits, symbols, and not a common password. Length 16 affects the score but does not have its own checklist row. Results appear as you type. The field starts hidden; a button toggles visibility. Autocomplete is off.
Is my password sent to a server or checked against a leak database?
No. The analysis runs in your browser against the local rules above. Nothing is uploaded, and there is no Have I Been Pwned or similar lookup. Closing the tab discards what you typed. Do not paste a production password on a shared screen.
Related tools and guides
References
- Strength meters such as zxcvbn use pattern matching and a much larger common-password dictionary. This page uses a seven-point checklist and 20 exact strings only.
- A dedicated password manager can store credentials and watch for breaches; this page only scores the text you type in the current tab.