How to Check Password Strength and What Entropy Means
See a password's length, character types, entropy in bits and a rough time to guess it, without sending it anywhere.
A password is only as strong as the work an attacker needs to guess it. Length and unpredictability matter far more than adding a symbol to a common word.
Quick answer
Type a password to see its length, character types, an entropy estimate in bits and a rough guess time. The check runs in your browser; the password is never sent or saved.
What entropy tells you
Entropy measures unpredictability in bits. Each extra bit doubles the guessing work.
- 40 bits: crackable quickly by offline attacks.
- 60 bits: hard for a casual attacker, weak against a determined one.
- 80 bits: strong for most online accounts.
- 100+ bits: very strong.
A random 12-character password using letters, digits and symbols is about 78 bits. A four-word random passphrase from a large word list is about 50 bits; six words is about 77 bits.
What makes a password weak
- Common words, names and dates.
- Predictable substitutions (
p@ssw0rd). - Keyboard patterns (
qwerty,1qaz2wsx). - Reused passwords from other sites.
- Short length.
Steps
- Open the tool.
- Type the password you are considering (use a similar one, not your real one, if you prefer).
- Read the score and tips.
Better habits
- Use a password manager to create long random passwords.
- Turn on two-factor authentication.
- Use a unique password per site.
- Prefer length (14+ characters) over complexity rules.
The estimate is a guide; real attack speed depends on how the site stores passwords.
