Password Strength Checker

What is a password strength estimator?

A password strength estimator scores a password by its length and character variety using entropy math — estimating how many bits of randomness it carries and roughly how long it would take to crack. It runs entirely in your browser, so the password never leaves the page.

How this estimator works

• It counts the character set size (lower, upper, digits, symbols) and multiplies by length.
• Entropy is measured in bits: each bit doubles the search space.
• Common passwords, repeated characters, and keyboard sequences are flagged and scored down.
• A rough crack-time estimate assumes a billion guesses per second.

How to use the result

1. Aim for “Strong” — typically 60+ bits, which usually means 12+ characters with a mix of types.
2. Prefer length over complexity: “correct-horse-battery-staple”-style passphrases beat short symbol-soup.
3. Never reuse the same password across accounts — one breach unlocks the rest.
4. Pair a strong password with a password manager, since memorising dozens of unique ones is unrealistic.

What makes a password strong?

Length is the biggest lever — each added character multiplies the search space by the size of the character set. A 14-character passphrase or random string with mixed characters is strong; a common word like “password” is weak no matter how it’s decorated. Uniqueness per account matters as much as strength.

Common mistakes

• Reusing passwords. A strong password reused on a breached site is compromised everywhere.
• Adding one symbol to a weak base. “password1!” is still essentially “password” — estimators catch the pattern.
• Relying on complexity instead of length. “P@ss!” loses to “purple-elephant-trampoline” every time.

Password strength is measured in bits — the same log-base-2 thinking behind the logarithm calculator. If you ever need a genuinely random value, the random number generator handles the low-stakes cases; use a password manager for the real ones.