Password Strength Checker

Written byOleh Soloninupdated 5 October 2026

Password

Result

Verdictstrong
Entropy, bits72.1
Time to crack1,605 years
Length11
Character pool94

Entropy, not a colour-coded guess

Measure a password's entropy in bits and see roughly how long a fast offline attack would take. Nothing is transmitted.

A capital at the front and a digit and symbol at the end add less than they seem to: the checker rates the pattern 'Word2026!' at about 31 bits, where the character-set formula alone would suggest about 59.

Entropy is length multiplied by the bits per character your alphabet provides. Length does most of the work, which is why a long random string beats a short mangled word.

How to use

Type the password — it never leaves your browser.
Read the entropy in bits and the rating from very weak to very strong.
Check the crack time and the alphabet size, and lengthen the password if needed.

How the checker rates different passwords

Times are for 100 billion guesses per second. The last two rows show where the method falls short: it overrates both the phrase and the mangled word.

Every row is output from this page's checker.
Password	Bits	Rating	Crack time	Alphabet
123456	19.9	very weak	under a minute	10
password	37.6	weak	under a minute	26
Summer2026!	30.9	very weak	under a minute	94
k8#Pz!2qW9vL	78.7	strong	150,913 years	94
Hx7!mQ2#vR9@tL4$	104.9	very strong	more than a million years	94
Tr0ub4dor&3	72.1	strong	1,605 years	94
correct horse battery staple	164	very strong	more than a million years	58

The rating scale

The label depends on the number of bits alone.

The bands are taken from the checker's code.
Bits	Rating
under 35	very weak
35–50	weak
50–70	fair
70–90	strong
90 and up	very strong

What this calculator shows

Entropy in bits and a plain verdict
Estimated time to crack under a fast offline attack
The character pool size the password draws from

What to keep in mind

Crack times assume 100 billion guesses per second — an assumption for a fast offline attack.
The checker spots the 'word + year + symbol' pattern, but not letter-for-digit swaps or dictionary phrases: it rates 'Tr0ub4dor&3' and 'correct horse battery staple' higher than they deserve.

FAQs

How many bits of entropy do I need?

On this checker's scale, strong starts at 70 bits. At 100 billion guesses a second, 70 bits takes about 374 years to exhaust; 90 bits takes hundreds of millions.

Is the password sent anywhere?

No. The calculation runs entirely in your browser and nothing leaves the page.

Why do dictionary passwords get inflated scores?

The formula sees length and character set, and of all the patterns it only knows 'word + year + symbol'. Real attacks try dictionaries, names and swaps like a → @ and o → 0 first, so 'P@ssw0rd123' falls almost at once.

Are passphrases better?

Yes, if the words are picked at random. The checker counts characters rather than words, so a four-word phrase scores over 150 bits here. The real strength depends on the word list: four words from EFF's 7,776-word list give about 52 bits, six give about 78.

Why is 'Summer2026!' very weak when it has everything?

The checker recognises the 'word + year + symbol' pattern and rates it at 31 bits instead of the 72 its characters suggest: running a dictionary with years and trailing symbols is one of the first things an attacker tries.

What does alphabet size mean?

How many different characters could stand in each position: 26 lowercase, 26 uppercase, 10 digits and 32 symbols. A password using all four kinds has an alphabet of 94.

Worked example

The famous example

Input: Tr0ub4dor&3

Output: About 72 bits by the formula

Note: The number flatters it. Because it is a dictionary word with predictable substitutions, real cracking software finds it far faster than the entropy suggests.

Useful links

All tools in Text tools for word count, character count, and quick cleanup

Password Strength Checker

Result

Related tools

Password Generator

Online Hash Generator

Base64 Encoder / Decoder

Useful links