Skip to content

Free browser tools that respect your files: everything runs locally, nothing is uploaded.

Password Strength Checker

Check how strong a password is by entropy: charset and length feed the math, hand-rolled pattern penalties (repeats, sequences, keyboard runs, dates, common words) subtract from it, and crack times come with their assumptions stated.

This checker runs entirely in this browser tab — you can watch the Network tab and see that nothing is sent. The field stays masked until you choose to reveal it.

Type a password to see its entropy estimate, pattern penalties, and crack-time ranges.

Pair it with the Password Generator

Found a weak password? Generate a high-entropy replacement with the characters and length you choose — same site, also entirely in your browser.

Open Password Generator

Nothing you type here is stored or transmitted — the analysis runs on this page, in this browser tab, and you can watch the Network tab to confirm it. Still, if the password already guards something real, checking it anywhere (here included) is your call to make.

Quick Answer

The password strength checker at practicalwebtools.com/other/password-strength-checker scores your password by entropy: length times log2 of the detected charset pool, minus penalties for repeats, sequences, keyboard runs, dates, and about 200 common words. It then estimates crack time at three stated attack rates, from throttled logins to fast offline hashing. Everything runs in this browser tab — the password is never sent or stored.

How It Works

1

Type or paste the password into the masked field — analysis runs as you type

2

Read the strength band, entropy in bits, and the detected charsets

3

Check which patterns (repeats, sequences, keyboard runs, dates, common words) subtracted bits

4

Compare the estimated crack times at the three stated attack rates

Key Facts

  • Entropy-based scoring: length × log2(charset pool) is the starting number
  • Hand-rolled pattern penalties: repeated characters, abc/123 sequences, qwerty keyboard runs, years and dates, and a ~200-word common-password list
  • Crack-time estimates at three stated rates: online throttled (100/s), offline bcrypt (20,000/s), offline SHA-1 (100 billion/s)
  • Average-case assumption shown with the results: attackers expect to guess halfway through the keyspace
  • Input stays masked as a password field, with an explicit show toggle
  • Never sent or stored: runs entirely in this browser tab — verifiable in the Network tab
  • Charset readout: lowercase, uppercase, digits, symbols, and the resulting pool size
  • Direct pairing with the free Password Generator for replacing weak finds

Frequently Asked Questions

How does this password strength checker work?

It estimates entropy. The base number is password length multiplied by log2 of the character pool — the number of possible characters actually used (26 each for lower and upper case, 10 for digits, 33 for symbols). Recognizable patterns then subtract from that base: repeated characters, sequences like abc or 123, keyboard-row runs like qwerty, years and dates, and words from a roughly 200-entry common-password list. The final bits drive the strength band and the crack-time estimates.

How long would my password take to crack?

The tool shows three estimates under stated assumptions: an online throttled attack at 100 guesses per second, an offline attack on bcrypt hashes at 20,000 guesses per second, and an offline attack on fast SHA-1 hashes at 100 billion guesses per second. Each assumes average luck — finding the password halfway through the keyspace. A 78-bit random password lands around 160 thousand years even against fast SHA-1, while 11 bits falls instantly.

What makes a password strong?

Length dominates. Each random character from a 95-character pool adds about 6.6 bits, so a 12-character random mix reaches roughly 79 bits, while 8 random lowercase letters hold only about 38. Patterns undo length fast: password123 scores around 11 bits because the word and the sequence are among the first things an attacker tries. A unique random string, or a passphrase of unrelated words from a big vocabulary, is the practical answer — and a password manager beats memorizing any of them.

Is it safe to type my real password here?

The checker runs entirely in this browser tab — the analysis is local JavaScript, the field is masked until you reveal it, and you can watch the Network tab in your developer tools to confirm no request carries what you typed. Nothing is stored. That said, prudent habit is to test a variation of a real password (similar length and character mix) rather than the exact one, on any checker, mine included.

Why did my password score lower than expected?

Almost always a pattern penalty. The checker lists each one it applied — a repeated character run, a sequence, a keyboard walk, a year, or an embedded common word (leet swaps like p4ssw0rd are normalized before matching). Swapping a→4 does not add entropy; it only decorates a word an attacker tries early. The penalty list shows exactly which patterns cost you how many bits.

What is the difference between this and the Password Generator?

This page judges passwords you already have; the generator makes new ones with chosen length and character sets, using the browser crypto random source. I built them as a pair: check what you have, then generate a replacement that scores where you want it.