Password Strength Checker (Free and Private)
Quick answer: a strong password is long (14+ characters), not a common word, and used on one site only. Type a test password below to see its strength and crack time.
🔒 Your password never leaves your device. This checker runs 100% in your browser with JavaScript. It does not send, save or log what you type. You can even switch off Wi-Fi and it still works.
Tip: do not type your real bank or email password into any website, even this one. Test a password that is like yours instead.
How this checker works
Why
Most hacked accounts use weak or reused passwords. A quick check shows you the weak spots before an attacker finds them.
What
The checker looks at 4 things: length, variety (small, capital, numbers, symbols), whether it is a common password, and easy patterns like 1234 or a year. From these it estimates how long a fast computer would need to guess it.
How
- Type a test password in the box.
- Read the colour bar: red is weak, green is strong.
- Read each line below the bar. Fix every red line.
- Try again until you see "Strong" or "Very strong".
Example, step by step
- Priya types
priya@123. - The checker says "Very weak". "priya" is a common name and
@123is a common ending. - Priya changes it to
Priya-Kettle-Rain-82. - Now it says "Very strong", with a crack time of millions of years.
What is crack time?
Why
Attackers who steal a password database try billions of guesses per second on their own computers. Crack time tells you how long your password would survive that.
What
Crack time is an estimate. We assume 10 billion guesses per second, which is a fast offline attack. Each extra character makes the time much longer. Common passwords are cracked in under a second, no matter how long they look.
How
- Count the kinds of characters you used (for example 26 small letters + 10 numbers = 36).
- Multiply that number by itself once for every character in the password. This gives the number of possible passwords.
- Divide by the guesses per second.
- Common words and patterns are tried first, so the checker lowers the score for them.
Example, step by step
- John uses
sunshine(8 small letters). - It is in every leaked list, so it falls in under a second.
- He uses
sunshine-tiger-lampinstead (19 characters). - The crack time jumps to centuries.
Ravindra Bagale's Tip
Length beats tricks. "P@ssw0rd" looks clever but attackers try it in the first second. Four random words joined with dashes are easier to remember and much harder to crack. And always switch on 2-step login for email and banking.
Ravindra Bagale's Tip – मराठी
Length ही खरी ताकद आहे. "P@ssw0rd" हुशार दिसतो पण attacker तो पहिल्याच सेकंदात try करतो. चार random शब्द dash ने जोडा — लक्षात ठेवायला सोपे आणि crack करायला खूप कठीण. आणि email व banking साठी 2-step login नक्की चालू करा.
Ravindra Bagale's Tip – हिंदी
Length ही असली ताकत है. "P@ssw0rd" होशियार दिखता है पर attacker उसे पहले ही सेकंड में try करता है. चार random शब्द dash से जोड़ें — याद रखना आसान और crack करना बहुत मुश्किल. और email व banking के लिए 2-step login ज़रूर चालू करें.
Tips for a strong password
Why
A strong password only helps if you also use it the right way. One reused password can open all your accounts.
What
Good habits are: a long passphrase, one password per site, a password manager, and 2-step login.
How
- Pick 4 random words, like
Mango Train Blue Pillow. - Join them with dashes and add a number:
Mango-Train-Blue-Pillow-47. - Use a different password for every site. A password manager (Bitwarden, 1Password, or the one in your phone) remembers them for you.
- Turn on 2-step login (OTP or authenticator app) for email, bank and social media.
- If a site tells you about a leak, change that password at once.
Example, step by step
- Sneha used the same password for Instagram and Gmail.
- Instagram data leaked, and attackers tried that password on Gmail.
- She now uses a password manager, so each site has its own password.
- A leak on one site no longer opens her other accounts.
Frequently asked questions
Does this tool send my password anywhere?
No. All checks run in your browser using JavaScript on this page. Nothing is sent, saved or logged. You can disconnect from the internet and the tool still works.
How long should my password be?
Use at least 12 characters. 14 or more is better. A passphrase of 4 random words is a good way to get there.
Is P@ssw0rd a strong password?
No. Swapping letters for symbols is a well known trick. Attackers try these versions first, so it is cracked almost at once.
Is the crack time exact?
No. It is an estimate for a fast offline attack at 10 billion guesses per second. Real attackers may be faster or slower. Use it to compare passwords, not as a promise.
What is better, a password manager or memorising?
A password manager is better for most people. You remember one strong master password, and it creates a different strong password for every site.