How password strength is scored
Strength comes from two things working together: how long the password is, and how many different character types it draws from. Each added character multiplies the number of possible combinations an attacker must try. Mixing lowercase, uppercase, numbers, and symbols widens that pool further, so a longer, more varied password becomes exponentially harder to guess.
Frequently asked questions
How is my password strength measured?
This checker scores your password on length and the variety of character types it uses (lowercase, uppercase, numbers, and symbols), then estimates how large the search space is. A larger search space takes far longer to brute-force, which raises the strength rating.
Is it safe to type my real password here?
Yes. The check runs entirely in your browser using JavaScript. Your password is never sent to a server, never logged, and never stored. You can confirm this by disconnecting from the internet and seeing that the tool still works.
What makes a strong password?
Length matters most. Aim for at least 12 to 16 characters, mix uppercase and lowercase letters with numbers and symbols, and avoid dictionary words, names, dates, and keyboard patterns like qwerty or 123456.
What does the estimated crack time mean?
It is a rough estimate of how long an attacker would need to try every possible combination of the character set you used, assuming a fast offline guessing rate. It is a guideline, not a guarantee, and a reused or leaked password can be cracked instantly regardless of strength.
Should I reuse a strong password across sites?
No. Even a very strong password becomes worthless if it leaks from one site and you used it elsewhere. Use a unique password for every account, ideally generated and stored in a password manager.
Related calculators
Disclaimer: The strength rating and crack-time estimate are simplified approximations for general guidance only and do not account for dictionary attacks, leaked-password databases, or targeted guessing. Never rely on a single score for accounts that protect sensitive data; use unique passwords and a password manager.