Password strength checker
| Characters | |
| Strength |
What this password strength checker does
Type a candidate password and the tool estimates how hard it would be to guess using common heuristics: length, character-class diversity, patterns like keyboard walks, and repeated chunks. It is a coaching signal, not a formal cryptographic proof. A green rating still fails if you reuse the secret across sites, store it in plaintext chat, or paste it into a phishing form. Use it when picking a new vault passphrase or vetting a generator output before you rotate credentials.
When to use it
Use it during security awareness drills, after a breach notice forces resets, or when onboarding relatives away from Winter2024! clones. Pair with Password generator for random secrets you cannot memorize at scale, and keep a real password manager as the system of record—this page never stores what you type, but you should still avoid testing production passwords on shared screens.
Worked example
You propose correct-horse-battery-staple-city-7419 as a master passphrase. The checker likely scores it well because length dominates entropy. You then try Pa$$w0rd! and watch the score collapse: substitutions do not fix short templates attackers already brute force. The lesson is measurable: favor length and randomness from a CSPRNG for machine passwords; favor memorable unrelated words only when your threat model allows and you never reuse the phrase.
Frequently asked questions
Does a strong score mean the password was never leaked?
No. Breach databases are separate. Use unique passwords per site so past dumps cannot unlock other accounts.
Should I type my real banking password here?
Prefer testing structures or use offline vault tools. Any web field could be shoulder-surfed or logged by extensions.
Are passkeys replacing this?
WebAuthn passkeys reduce phishing for supported sites, but passwords remain everywhere. Strength checks still matter for legacy apps.
Why does my random string score oddly?
Heuristics penalize patterns or tiny character sets. If you generated bytes from a trusted RNG, trust the generator and the vault, not only this label.