How password strength is measured
What this checker measures
The checker gives your password a number of bits, a strength word and a list of what it found. It works in three steps. First it looks for an exact match in a built-in list of the 10,000 most common passwords, such as "password", "123456" and "qwerty". A match there is the worst result, because those are the first guesses any attacker makes. Second it looks for patterns that make a password easier to guess: a plain dictionary word, a word with digits or a year on the end, look-alike swaps such as "@" for "a" and "0" for "o", runs of keys like "qwerty" or "asdf", repeats such as "aaaa" or "abab", sequences such as "abcd" or "9876", dates, and a common password with one character changed. Third it adds up the cost of guessing each part. Parts that match a pattern are cheap, and the rest is priced by length and the kinds of characters used: lowercase, capitals, digits and symbols.
The answer is an estimate and not a guarantee. It does not know which passwords have leaked, and it knows only 10,000 common words, so it can rate an unusual but guessable password too high. Treat a weak result as reliable and a strong result as a good sign.
Why online checkers are a risk
A password checker asks you to type the very thing you are trying to protect. If the page sends what you type to a server, even only to count it, that server now has your password. A careless or dishonest site could log it, and a script from an advertiser or analytics service on the page could read it too. So treat any online checker as a place where your real password might be seen, and prefer one that you can verify.
You can verify this one. Open your browser's developer tools (F12, or Option+Command+I on a Mac) and choose the Network tab. Type into the box above and watch the list: no new requests appear. The page also carries a content security policy that tells the browser to refuse any outgoing connection, and its code is two plain files you can read. Even so, the safest habit is to test a password that is similar in style to your real one and not the real one.
What NIST says
The US standard for digital identity, NIST SP 800-63B-4, gives three rules that match the way this checker works. A password used on its own, as the only factor, should be at least 15 characters. Sites should not force composition rules, such as one capital, one digit and one symbol, because they push people into predictable patterns. And sites should check new passwords against lists of passwords that are common or that appeared in breaches, and reject those. Length and uniqueness matter. Forced complexity does not.
Why length beats symbols
Every extra character multiplies the guesses needed, but a symbol swapped into a word barely does. An attacker's tools already try "a" as "@" and "o" as "0", so "P@ssw0rd" is about as weak as "password". Compare two secrets. An eight-character password drawn from all 95 typeable characters has at most about 52 bits, and only if it is truly random. Six random words from a 7,776-word list have about 77 bits, and are easier to remember and type. Each extra random word adds about 13 bits. People rarely choose characters at random, so the cheap trick of making a short password look complicated gains little.
If your password is weak
Change it, and do not reuse it anywhere else. If it is for an account you care about, change it now, because a weak password that is found in a breach can be used to try your other accounts. Let a password manager make a long random password for each account, so you never need to remember them. For the few secrets you must remember, such as the manager's master passphrase and your device login, use a passphrase of six random words, and write it on paper at home until it sticks. Turn on a second factor or a passkey where it is offered. To find out whether a password has already leaked, use haveibeenpwned.com, which this checker does not replace.
Frequently asked questions
Is it safe to type my password here?
It is as safe as a page can be made. The check runs in your browser, the page makes no network requests, and it has no analytics, no form submission and no server call. Open the Network tab in your browser's developer tools, type something and watch: nothing is sent. Even so, the safest habit is to test a password that is similar in style to yours rather than the real one.
Can a site see what I type here?
Not this one. The page has a content security policy that blocks all outgoing connections, and the scripts are two plain files you can read. A site could see a password you type if it wanted to, which is why you should only trust a checker you can verify. Browser extensions can also read page contents, so use a private window with extensions off if you are cautious.
Does this check breached passwords?
No. It checks your password against a built-in list of the 10,000 most common passwords and looks for patterns, but it does not know which passwords have leaked. For breach checks, use haveibeenpwned.com. Its Pwned Passwords tool uses a k-anonymity method that sends only part of a hash, never your password.
How strong should my password be?
For a password manager master passphrase, a disk encryption passphrase or anything attackable offline, aim for 80 bits or more. For ordinary accounts with rate-limited logins and a manager making unique random passwords, 60 bits is plenty. Length matters most: NIST 800-63B-4 sets 15 characters as the minimum when a password is the only factor.
What is entropy?
Entropy, in bits, is a measure of how many guesses an attacker needs. Each added bit doubles the work. A password with 40 bits needs about a trillion guesses to be certain of finding it, and half of that on average. The figure here is an estimate based on length, the character types used and the patterns found.
Why does my 8-character password with symbols score low?
Eight characters from a pool of 95 gives at most about 52 bits, and only if every character is random. Real passwords are rarely random. A capital first letter, a word in the middle and a symbol and number on the end are the most common shapes, and attackers try them first, so the estimate drops sharply. Length beats symbols.
Should I use a passphrase or a password?
Use both. A random password from a manager suits the accounts you never type from memory. A passphrase of six or more random words suits the few secrets you must remember, such as the manager's master passphrase and your device login. Our passphrase generator makes one with the EFF word list.
What about passkeys?
Passkeys replace the password with a key pair held on your device, so there is nothing to guess, reuse or phish. Use them wherever a site offers them. You still need a strong secret for the manager or device that holds your passkeys, and for sites without passkey support.