Toolstia / password strength checker
Password strength checker
Type a password to see a strength rating, an estimate in bits, and how long it might take to guess with an online or offline attack. Common passwords, repeats and easy sequences are flagged. Nothing you type is sent anywhere.
Your password never leaves this page. The result is an estimate based on length, variety and a few common patterns. It cannot know if your password is built from a real word, a name or a date, which attackers try first, so treat a high score as a ceiling, not a guarantee.
How it works
- Type or paste a password.
- Read the rating and the guessing-time estimates.
- Open the tips to make it stronger.
How the estimate works
Strength in bits is the length multiplied by the log of the character types used, then reduced for common passwords, repeated characters, easy sequences and year endings. Each extra bit doubles the guesses needed.
Guessing time
The offline figure assumes 10 billion guesses per second against a leaked password database. The online figure assumes 1,000 guesses per second against a login page with no lockout.
Length wins
A long passphrase of four or more unrelated words is usually stronger and easier to remember than a short password full of symbols.
Limits
The tool cannot know if your password comes from a dictionary word, a name or a date. Treat a high score as the best case. Use a different password for every account and a password manager.
Questions
Is my password sent anywhere?
No. It is checked entirely in this page and never leaves your device.
What makes a password weak?
Short length, common words, repeats, keyboard sequences and anything about you that others could guess.
Is anything uploaded?
No. Everything is done in your browser and nothing is sent anywhere.