Password Strength Checker

This checker rates a password from Very Weak to Very Strong and estimates how long a brute-force attack would take. It works out entropy from the length and the types of characters used. Then it lowers that score when it spots a common password, a keyboard run, repeats or a sequence.

The base score is length times log2 of the pool size. The pool counts 26 for lowercase, 26 for uppercase, 10 for digits, 33 for symbols and 1 for a space. A 10-character password with all four types scores about 66 bits. Penalties then shrink that number. A common password such as password or 123456 multiplies it by 0.3. A keyboard run like qwerty or 1234 multiplies it by 0.5. Three repeated characters or a run like abc or 321 each multiply it by 0.7. Using only one type of character in a password under 20 characters multiplies it by 0.6. The score out of 100 is the final entropy divided by 128.

Crack time assumes 10 billion guesses per second, a rough figure for fast hardware attacking a stolen database. Real attackers are smarter than pure brute force. They try leaked passwords, words, names and years first. The strength score has no dictionary, so a famous phrase such as correct horse battery staple still scores Very Strong. Treat a high score as a good sign, not a promise.

That is what the data breach check is for. Press the button and the tool asks Have I Been Pwned whether the password appears in known breaches. Your browser hashes it with SHA-1 and sends only the first 5 characters of the hash, so the password never leaves your device. A breached password is flagged in red under the meter, whatever its score. That famous phrase, for example, shows up in 391 breaches. The strength analysis itself runs as you type and sends nothing. If a password scores poorly or is breached, replace it with one from the Password Generator. For more detail on a leak, use the Password Breach Checker.