Password Strength
Check how strong your password is. Get security score, crack time estimate, and improvement suggestions. Free online password analyzer.
Formula
Score based on length, entropy, and pattern matching
We analyze character set size and length to calculate entropy. We also deduct points for known weaknesses like dictionary words, repeated characters, and common sequences.
Worked Examples
Example 1: Weak Password
Problem:Analysis of 'Password123'
Solution:Score: 10/100 Crack Time: Instant Issues: - Common word - Predictable pattern - Too short Verdict: Extremely vulnerable to dictionary attacks.
Result:Do not use!
Example 2: Moderate Password
Problem:Analysis of 'MyDogRex1990'
Solution:Score: 45/100 Crack Time: 2 days Issues: - Uses dictionary words - Uses personal info (year) - No symbols Verdict: Better than 'Password123' but still guessable.
Result:Okay for low-risk sites
Example 3: Strong Password
Problem:Analysis of 'K7$mP9#vL2@qX5'
Solution:Score: 100/100 Crack Time: Billions of years Features: - 14 characters - Random mix of all types - No patterns Verdict: Excellent for banking or primary email.
Result:Highly Secure
Frequently Asked Questions
What makes a strong password?
A strong password is at least 12 characters long (16+ is better) and includes a mix of uppercase letters, lowercase letters, numbers, and special symbols. It should not contain personal information, dictionary words, or predictable patterns.
How is 'Time to Crack' calculated?
We estimate the number of possible combinations based on the characters used (e.g., 26 lowercase + 26 uppercase = 52 possibilities per character). We then divide this total by a hypothetical cracking speed (e.g., 10 billion guesses per second) to estimate the time required.
Why is length more important than complexity?
Each additional character exponentially increases the number of possible combinations. A 15-character password of just lowercase letters is often stronger than an 8-character password with complex symbols because the search space is vastly larger.
Should I use a password manager?
Yes! Password managers allow you to use unique, complex, random passwords for every single account without needing to memorize them. You only need to remember one strong master password.
Is my password safe on this tool?
Yes. Password Strength runs entirely in your browser. Your password is never sent to any server, stored, or shared. You can even disconnect from the internet while using it to be sure.
What is entropy in passwords?
Entropy measures the unpredictability or randomness of a password in bits. Higher entropy means it's harder for an attacker to guess. A random string has high entropy; a dictionary word has low entropy.
How often should I change my password?
Modern advice is to only change passwords if you suspect a breach. Forced regular changes often lead to users choosing weaker, predictable passwords (e.g., changing 'Pass1' to 'Pass2').
What is Two-Factor Authentication (2FA)?
2FA adds a second layer of security (like a code sent to your phone) beyond just your password. Even if a hacker guesses your strong password, they cannot access your account without the second factor.
Why are dictionary words bad?
Attackers use 'dictionary attacks' that try every word in the dictionary (and common variations) in seconds. Random strings like 'x9#mK2$p' are not in dictionaries and are immune to this specific attack method.
Are passphrases better than passwords?
Passphrases using 4-6 random words (like correct-horse-battery-staple) can be both stronger and easier to remember than complex short passwords. A 4-word passphrase from a large dictionary provides excellent entropy while remaining memorable.
Background & Theory
Password security relies on Entropy (randomness) and Search Space (total possible combinations).
Combinations Calculation:
C = N^L
where N is the character set size and L is the length.
Character Sets:
- Numbers only: N=10
- Lowercase: N=26
- Alphanumeric: N=62 (10+26+26)
- Full Keyboard: N=95 (10+26+26+33 symbols)
Example:
- 8-char lowercase: 26^8 ≈ 200 billion combinations.
- 8-char complex: 95^8 ≈ 6 quadrillion combinations.
- 12-char lowercase: 26^12 ≈ 95 quadrillion combinations.
Notice: Increasing length (12 chars simple) is often more effective than increasing complexity (8 chars complex).
Attack Types:
- Brute Force: Trying every single combination.
- Dictionary Attack: Trying words from a list.
- Credential Stuffing: Trying passwords stolen from other sites.
- Social Engineering: Guessing based on user info (names, dates).