Password Strength Checker
Password Strength Checker estimates bits as length × log2(detected character pool), then labels results below 50 as Weak, 50–79.9 as Moderate, and 80 or more as Strong. This is a simple mathematical model, not a guessability engine: it does not detect common passwords, names, keyboard paths, leaks, repeated patterns, or service-specific attack conditions.
Runs locally — files stay on your deviceCan this checker prove a password is strong?
No. Its estimate assumes independent random choice from a character pool, which is usually false for human-created passwords.
Character-pool entropy is an upper-bound model
The formula L × log2(P) assumes each of L positions is sampled independently and uniformly from P characters. Human choices are structured and often much easier to guess.
How it works
The tool detects lowercase, uppercase, digits, and other characters, assigns a fixed pool size for each present class, multiplies the logarithm of the combined pool by text length, and applies fixed labels.
Key concepts
Patterns defeat pool assumptions
Password1! uses several classes yet is highly predictable.
Online and offline attacks differ
Server throttling, hash storage, MFA, and breach exposure change real risk.
When to use it
- Compare the model's response to length and character classes.
- Demonstrate why random length increases theoretical space.
- Inspect the exact heuristic used by this page.
When not to use it
- Do not approve production passwords from this label.
- Do not paste real credentials on an untrusted device.
- Do not substitute the score for a breached-password blocklist or rate limiting.
Worked examples
Predictable composition
- Input
Password1!- Expected output
Possibly inflated estimate
The heuristic sees classes, not common structure.
Repeated characters
- Input
aaaaaaaaaaaaaaaaaaaa- Expected output
Length-based estimate
Repetition is not penalized.
Random manager output
- Input
A long random value- Expected output
Higher model estimate
The assumptions fit machine generation better than human choice.
Common mistakes
Treating bits as measured security
The value is model-derived, not tested against cracking dictionaries. Correction: Use a guessability model and breach checks.
Optimizing the meter
Predictable suffixes can raise the displayed score. Correction: Generate a unique random password instead.
Ignoring storage security
A strong input can be undermined by fast unsalted hashing. Correction: Use modern password hashing and MFA.
Best practices
- Prefer length, uniqueness, blocklists, and password managers.
- Treat the label as educational only.
- Evaluate the whole authentication system.
Related operations and differences
JWT Header Viewer
Choose JWT Header Viewer when you need to decode a JWT header without verifying its signature.; use Password Strength Checker specifically for strength.
Password Entropy Calculator
Choose Password Entropy Calculator when you need to calculate estimated entropy from an assumed character pool.; use Password Strength Checker specifically for strength.
SRI Hash Generator
Choose SRI Hash Generator when you need to generate a Subresource Integrity value for pasted content.; use Password Strength Checker specifically for strength.
Basic Auth Header Generator
Choose Basic Auth Header Generator when you need to generate a Basic Authorization header locally.; use Password Strength Checker specifically for strength.
HMAC Generator
Choose HMAC Generator when you need to create an HMAC using the browser Web Crypto API.; use Password Strength Checker specifically for strength.
JWT Expiration Checker
Choose JWT Expiration Checker when you need to inspect the exp claim in a JWT.; use Password Strength Checker specifically for strength.
Limitations and privacy
- No dictionary, breach, pattern, keyboard, name, or contextual analysis.
- Fixed pool and label thresholds.
- Does not model server-side hashing or throttling.
The entered value is processed locally in this browser. Avoid using an untrusted device for real credentials or secrets.
Frequently asked questions
What formula is used?
Length × log2(detected pool size).
Does it check breached passwords?
No.
Can a common password score highly?
Yes.
Is the Strong label a guarantee?
No.