DevTools Logo

Password Strength Checker

Password Strength Checker

Analyze your password strength and get security recommendations

Password Input

Password Security Tips

✅ Do:

  • • Use 12+ characters when possible
  • • Mix uppercase, lowercase, numbers, and symbols
  • • Use unique passwords for each account
  • • Consider using a password manager
  • • Use passphrases with random words

❌ Don't:

  • • Use personal information (names, dates)
  • • Use common passwords or dictionary words
  • • Reuse passwords across multiple sites
  • • Use simple patterns (123456, qwerty)
  • • Share passwords or write them down unsecurely

Examples

A listed common password

Input
password
Output
Score: 35/100
Rating: Weak
Estimated crack time: Minutes - Hours

It passes the eight-character and lowercase checks but loses the common-word points and contains no uppercase letters, numbers, or supported symbols.

A long lowercase passphrase

Input
correcthorsebatterystaple
Output
Score: 70/100
Rating: Good
Estimated crack time: Months - Years

The 12- and 16-character bonuses raise the score even though uppercase, number, and symbol checks remain false.

A candidate that satisfies every rule

Input
Mango-River-Quartz-84!
Output
Score: 100/100
Rating: Strong
Estimated crack time: Centuries+

This value passes every implemented check and reaches both length bonuses; the rating still does not prove that a real password is unique or unguessable.

About this tool

The Password Strength Checker uses a transparent, rule-based score rather than zxcvbn or a raw entropy formula. It awards points for reaching eight characters, including lowercase letters, uppercase letters, numbers, and supported symbols, and avoiding a short built-in list of common password substrings. It also adds length bonuses at 12 and 16 characters and caps the displayed score at 100.

Scores map to five ratings: Very Weak below 30, Weak below 50, Fair below 70, Good below 85, and Strong at 85 or above. The interface shows which checks passed, gives targeted suggestions for missing character classes or insufficient length, and lets you reveal or hide the entered value.

The displayed crack-time label is a coarse category derived from the same score, not a measured attack simulation or a dictionary-aware estimate. Use the result as quick composition feedback, then prefer a long, unique password generated and stored by a password manager; a high score cannot detect reuse, leaked credentials, personal information, or every predictable pattern.

How to use

  1. Enter the candidate password

    Type a password into the input. Analysis updates on every change; use the eye button only when it is safe for the value to be visible on screen.

  2. Read the score and rating

    Review the score out of 100, the Very Weak through Strong rating, and the broad estimated crack-time category.

  3. Check each requirement

    Inspect the pass/fail rows for length, lowercase, uppercase, numbers, symbols, and the built-in common-password check.

  4. Apply the suggestions and reassess

    Increase length and address relevant suggestions, but also check factors the meter cannot know: uniqueness, randomness, breach exposure, and whether the password contains personal information.

Use cases

Giving immediate signup feedback

Use the checklist as a simple model for showing which composition requirements a candidate meets before account creation.

Comparing length and composition

Try variants of the same candidate to see how eight, 12, and 16 characters and different character classes affect this tool's score.

Demonstrating password-meter limitations

Compare predictable and random-looking candidates to explain why a rule score is only one signal and cannot replace breach checks or pattern-aware estimation.

Reviewing a password policy UI

Check whether user-facing guidance clearly distinguishes minimum composition checks from broader advice such as uniqueness and password-manager use.

Common mistakes

Mistake:Treating a character-set score or entropy calculation as a realistic crack-time guarantee.

Fix:Dictionary words, keyboard walks, dates, and substitutions drastically reduce real search cost. This tool's crack-time text is only a score bucket, so use pattern-aware and breached-password checks in an actual authentication system.

Mistake:Favoring short complexity over length.

Fix:Prefer a long, unique passphrase or a password-manager-generated value. Extra length expands the search space more reliably than predictable substitutions such as `P@ssw0rd`.

Mistake:Including names, birthdays, employers, or other personal information.

Fix:The meter does not know your identity or public profile. Remove personally associated terms and use unrelated random words or generated characters instead.

Mistake:Reusing a high-scoring password across accounts.

Fix:A password exposed by one service is unsafe everywhere it was reused, regardless of its score. Generate a unique value for every account and store it in a password manager.

Frequently asked questions

References & standards

Related tools

AES Encryption

Encrypt and decrypt text with AES-GCM and a passphrase, fully in your browser. Uses PBKDF2 key derivation and the Web Crypto API — your data and keys never leave your device.

Basic Auth Generator

Generate an HTTP Basic Authentication header from a username and password. Produces the Authorization header and ready-to-use curl and fetch snippets. Runs fully client-side.

Bcrypt Generator & Verifier

Hash passwords with bcrypt and verify hashes — choose your cost factor (rounds 4–15), get a secure hash instantly, and check whether a password matches a hash. Runs entirely in your browser.

BIP39 Mnemonic Generator

Generate and validate BIP39 seed phrases locally for testing

Checksum Calculator

Compute file checksums (SHA-1, SHA-256, SHA-384, SHA-512) in your browser with the Web Crypto API

CORS Header Validator

Validate Cross-Origin Resource Sharing headers for security compliance