Password Strength Checker
See how strong a password really is — entropy, crack time, detected patterns and clear suggestions. Optionally check it against known data breaches. Nothing is transmitted except an optional 5-character hash prefix.
🔒 Analysis runs entirely in your browser. Your password is not sent anywhere.
🎲 Strong Password Generator
Generated with crypto.getRandomValues — your browser's cryptographic random number generator, the same source used for encryption keys. Not Math.random().
💡 Finding This Password Checker Useful?
Get the standalone version — a single HTML file you can keep on your machine, offline, with no scripts loaded from anywhere.
🛒 Get the Standalone Version🔍 What Is a Password Strength Checker?
A Password Strength Checker estimates how difficult a password would be for an attacker to guess. It does this by looking at the size of the character pool, the length, and the presence of common patterns — dictionary words, repeated characters, sequential runs, keyboard walks, and years — and producing an entropy figure measured in bits. That figure is then mapped to a plain-language score and a crack-time estimate under two attack speeds. This tool adds an optional breach check against Have I Been Pwned using k-anonymity, and a cryptographically secure password generator.
✨ Key Features
Real Entropy Estimate
The score is based on bits of uncertainty — pool size × length — with penalties for the patterns attackers try first.
Two Crack-Time Estimates
See both a throttled online attack (10,000 guesses/sec) and a fast offline attack (10 billion guesses/sec).
Pattern Detection
Catches dictionary passwords, leet-speak substitutions like p@ssw0rd, keyboard walks, sequences, repeats, and years.
Composition Breakdown
See exactly how many lowercase, uppercase, digit, symbol, space, and non-ASCII characters your password contains.
Optional Breach Check
Uses Have I Been Pwned's k-anonymity API — only a 5-character SHA-1 prefix leaves your browser, never the password.
Secure Password Generator
Builds passwords with crypto.getRandomValues, unbiased character selection, and a Fisher-Yates shuffle.
📖 How to Use the Password Strength Checker
- Type or paste a password into the input field. The analysis updates as you type.
- Watch the meter and score — five segments light up as the password gets stronger, and the label explains the result in plain words.
- Read the details — entropy in bits, charset size, and crack times for online and offline attacks.
- Review the issues and suggestions — the tool lists every pattern it detected and what you could change.
- Optionally check breach status — click Check breach to see whether the password has appeared in known leaks.
- Need a new password? Use the generator below, then click Send to checker to score it.
🎯 Practical Use Cases
Before Reusing a Password
Check whether a password you are about to reuse is actually strong or just feels that way.
Creating a New Password
Generate something genuinely random instead of relying on substitutions and personal details.
Teaching Password Hygiene
Show someone concretely why Summer2024! is not as strong as it looks.
Breach Awareness
Confirm whether a candidate password has already appeared in public breach dumps.
Understanding Entropy
Experiment with length versus character-class variety and see which moves the needle more.
Policy Compliance
Quickly verify a candidate meets a rough strength bar before setting it on an account.
⚠️ Important Notes and Limitations
Some honest caveats — this tool is a helpful heuristic, not a guarantee:
• Entropy is an estimate. It assumes an attacker who tries uniformly random guesses. Real attackers use dictionaries, patterns, and leaked password lists, which is why penalties are applied — but the number is still a simplification.
• Never type your real current password into any online tool, including this one, if you can avoid it. Even with client-side processing, the safest habit is to test a password that follows the same pattern, or use this tool for passwords you are about to adopt.
• Breach checking requires internet access and the Have I Been Pwned Pwned Passwords API. Only the first five characters of the SHA-1 hash are sent. If the API is unreachable or your browser lacks crypto.subtle, the button reports an error.
• The built-in common-password list is a curated subset — roughly 250 of the most frequently leaked entries, not the full billions-record corpus that HIBP uses. A password not flagged here may still be weak against a large dictionary.
• Pattern detection covers common cases only. Context-specific words, site names, and personal details are not checked.
• No score guarantees safety. A strong password can still be compromised by phishing, keyloggers, or a breach of the site itself.
❓ Frequently Asked Questions
No. The strength analysis runs entirely in your browser using JavaScript. Your password is not transmitted to any server. The optional breach check sends only the first five characters of a SHA-1 hash to the Have I Been Pwned Pwned Passwords API — never the password itself. That is the standard k-anonymity method the API was designed for, and the match happens locally.
The tool estimates entropy in bits by multiplying password length by the base-2 logarithm of the character pool size. It then applies multiplicative penalties for common patterns — dictionary words, leet-speak substitutions, sequential runs, keyboard walks, repeated characters, repeated substrings, and years. The final entropy is mapped to a 0–4 score: Very Weak (below 28 bits), Weak (28–36), Fair (36–60), Strong (60–90), Very Strong (90+).
Entropy is a measure of how many guesses an attacker needs on average. Each additional bit of entropy doubles the search space. A 40-bit password takes roughly a billion guesses; a 60-bit one takes roughly a quintillion. The estimates here assume an attacker tries half the space on average, which is the standard interpretation.
Yes, to the extent that k-anonymity allows. The tool computes SHA-1 of your password locally, sends only the first five hex characters of that hash to the API, and receives back a list of hash suffixes for every leaked password starting with that prefix. The comparison happens in your browser. The API never sees your password, and the prefix alone cannot identify it — it matches roughly one in a million hashes.
Yes. The generator uses crypto.getRandomValues, the browser's cryptographically secure random number generator, not Math.random(). Characters are picked with rejection sampling to avoid modulo bias, and the result is shuffled with the Fisher-Yates algorithm. When "Avoid look-alikes" is on, the characters I, l, 1, O, 0, and o are excluded from the pool.
Because length multiplies the search space directly, while adding a new character class only adds a constant factor. Going from 8 to 16 characters multiplies the pool by itself, which is far more than the difference between a 62-character alphabet and a 95-character one. This is why "correct horse battery staple" scores very high even though it uses only lowercase letters and spaces.
No. It can tell you that no obvious weakness was detected at the time of analysis. It cannot prove a password is safe against a determined attacker with a large dictionary, and it cannot protect you from phishing, keyloggers, or a breach of the site where you use the password.
👨💻 About the Author — GenieDevs
📦 Get the Standalone Version
🔐 Password Strength Checker – Standalone Edition
One self-contained HTML file with the full checker and generator inside. Keep it on your machine or on a USB stick and open it any time, offline, with no scripts loaded from anywhere.
✅ Final Takeaway
Most password advice is vague — "use a mix of letters and symbols" doesn't tell you whether you are actually improving anything. This checker turns that advice into numbers: bits of entropy, guesses per second, and an honest crack-time estimate. Use it before you commit to a new password, or when you want to see why one password is stronger than another. Just remember the one habit that matters most: use a unique password for every account, and store them in a password manager rather than in your head.