How Strong Is My Password?
See what an attacker recognises in your password, and how long it really survives.
The estimate updates as you type. It is worked out entirely by this page — there is no request to send, and no way for us to see what you entered.
What the number above is actually measuring
Most strength meters compute one thing: your password’s length multiplied by the size of the character set you drew from. It is a fine formula for a password chosen at random, and a badly misleading one for a password chosen by a person — which is nearly all of them.
Password123! scores about 79 bits by that formula. Twelve characters, four character classes, satisfies every corporate policy ever written. A cracking rig reaches it in well under a second, because it is not twelve independent choices. It is one dictionary word, one capital in the position everyone puts it, three digits in the order everyone uses, and one symbol at the end. Four decisions, all predictable.
So this page does something different. It breaks your password into the cheapest sequence of recognisable pieces it can find, prices each piece by how many guesses reaching it costs, and multiplies. Anything it does not recognise is charged at full brute-force rates. The result is the log₂ of that total, and the “what an attacker recognises” list is the decomposition it settled on — the actual route in, not a list of everything suspicious.
The patterns it prices
| Pattern | Example | What it costs an attacker |
|---|---|---|
| Breached password | iloveyou | Its position in the list. Often single digits. |
| Dictionary word | dragonfly | The size of the word list, times a small factor for capitalisation. |
| Character substitution | p@ssw0rd | The word’s cost, times about four. Tools undo these automatically. |
| Keyboard run | qwerty, asdfgh | A few thousand. Every tool generates these directly. |
| Sequence | abcdef, 4321 | Under a thousand. |
| Repetition | abcabcabc | The cost of abc, not of nine characters. |
| Year or date | 1987, 04121990 | A century of years is 120 guesses. Dates are under 40,000. |
| Anything else | x7#qL | Full brute force, at the alphabet size you used. |
Position matters too, though not in the way people expect. Moving the digits from the end to the middle of a word helps a little, because it breaks the word into two shorter pieces the dictionary matcher cannot span. It helps far less than adding four more random characters.
Where this estimate is too generous
Worth stating plainly, because a strength checker that oversells itself is worse than none: every figure on this page is an upper bound.
The dictionary here is 2,099 common English words and 181 of the most-breached passwords. That is enough to catch the failures that account for most compromised passwords, and nowhere near what a real attacker uses. Their lists run to hundreds of thousands of words, in every language, plus given names, surnames, place names, football clubs, band names, and the full contents of every public breach going back fifteen years.
The concrete version: Tr0ub4dor&3 — the XKCD example, and a genuinely weak password — scores around 72 bits here, because “troubadour” is not in a 2,000-word list. A tool whose dictionary contains it prices the same string at roughly 28 bits. The gap is not a bug in the arithmetic; it is the size of the dictionary, and it is why a good score here means no obvious weakness was found rather than this password is safe.
If the result was bad
The instinct is to patch the password that failed — add a symbol, swap a letter for a number, put a 2026 on the end. That produces a password one step away from the original, which is exactly the transformation cracking tools apply. If a password scored badly, replace it rather than repair it.
The generator will produce a replacement, and for the two or three you actually have to remember, its passphrase mode is the better option — six random words is around 66 bits and survives being typed by a human, which twenty random characters does not.
One thing no strength checker can see, and the one that matters most: whether you have used this password anywhere else. The dominant way accounts are lost is not guessing but credential stuffing — a password leaked from one site being replayed against every other site with the same email address. A 120-bit password used in two places offers no protection at all in the second one once the first is breached.
Questions about the score
Is it safe to type my real password into this page?
Into this one, yes — the estimate is calculated by JavaScript already running in your browser, and there is no request that carries it anywhere. You can watch the network tab while you type and see that nothing is sent. As a habit, though, be sceptical: many strength checkers post the password to a server to score it, and a page that does that has your password before you have finished deciding whether to trust it. If you would rather not risk the judgement, type something structurally similar instead of the real thing.
Why does this give a much lower score than other password checkers?
Because most of them only measure length and which character types you used. By that measure Password123! is about 79 bits and looks excellent. This page instead asks what an attacker would try, finds a dictionary word, a predictable capital, a run of digits and a trailing symbol, and prices the whole thing at around 13 bits — a fraction of a second. Where the two numbers disagree, the lower one is the one describing reality.
What is a bit of entropy?
One bit is a doubling. A password with 40 bits of entropy was drawn from about a trillion possibilities; 41 bits means two trillion. It is a useful unit precisely because it turns "stronger" into arithmetic: going from 60 to 70 bits is a thousandfold increase in work, whereas going from "medium" to "strong" on a coloured bar tells you nothing you can act on.
My password scored well. Is it safe to use?
It means no obvious weakness was found, which is not the same claim. This page checks against roughly 2,000 common words and 180 breached passwords; real cracking tools use dictionaries hundreds of times larger, along with names, places and every password from every previous breach. Treat a good score as a ceiling on your strength rather than a guarantee — and remember that the most common way accounts are actually lost is reuse, which no strength checker can detect.
Does substituting @ for a or 0 for o help?
Almost not at all. Every serious cracking tool applies those substitutions automatically as it walks its word list, so p@ssw0rd costs it a handful of extra attempts over password rather than a meaningfully larger search. The checker above models this: it un-substitutes what you typed before looking the word up, and charges only a small multiplier for the trouble.
How many guesses per second can an attacker really make?
It depends almost entirely on how the site stored the password, which you cannot know from outside. Guessing at a login form is slow and usually rate-limited — hundreds per second at best. Against a leaked database of bcrypt or Argon2 hashes, a few thousand per second. Against leaked unsalted MD5 or SHA-1, commodity GPUs reach into the hundreds of billions. That is why the tool shows all three rather than picking one and calling it the answer.
A strength checker measures one specific risk: someone guessing their way into an account. It says nothing about what your network reveals while you are signed in, which is a separate problem with a separate answer. Run the full privacy check
Last reviewed . Found something out of date? Tell us.