CoditTools
Tools/Security Tools/Password Strength Checker

Password Strength Checker – Test How Secure Your Password Is

Check how strong your password is online free - nothing is saved or sent to any server. Get instant feedback from a 7-point length and character-variety checklist, plus an estimated crack time.

If this tool isn’t working as expected, please take a screenshot of the error and report the problem here so we can investigate and improve it.

About this tool

A quick score can help you spot an obviously weak password - too short, a common password with a digit or symbol added, a keyboard pattern - before you use it. It's a useful first check, but it only knows a limited built-in list and a few patterns, so a password that is not flagged is not guaranteed to be safe: names, dates, and personal information are not checked, and nothing is compared with real breach databases.

Type a password to see it scored against 7 criteria - length (8+ and 12+), uppercase, lowercase, numbers, special characters, and whether it avoids very common passwords and predictable patterns. Common passwords are recognized even with simple tricks such as a capital first letter, trailing digits, or letter-to-symbol swaps (Password1, P@ssw0rd, Summer2024!), and sequences, keyboard walks, and repeated characters are flagged. It is an informational rule-based estimate, not an entropy calculation or a guarantee. Nothing you type is sent anywhere; the check runs entirely in your browser.

How to Use Password Strength Checker

Enter Password

Type your password - it never leaves your browser.

See Strength

Instantly see the strength rating: Very Weak to Very Strong, based on a 7-point checklist.

View Analysis

See the breakdown: length, uppercase, lowercase, numbers, symbols, and the common-password check.

Review the Checklist

See exactly which of the 7 criteria pass or fail.

Common Workflows

Type Your Password

Nothing is sent anywhere - the checks run instantly in your browser as you type.

Read the Score and Level

The 0-7 score maps to a level from Very Weak to Very Strong, plus a rough crack-time label from a fixed lookup table.

Read the Warnings

If the password resembles a common password or contains a sequence, keyboard walk, or repetition, the reason is listed under the score.

Check the Criteria List

Each of the 7 checks shows a ✓ or ✗ - length (8+ and 12+), uppercase, lowercase, numbers, special characters, and the common-password / pattern check.

Best For

  • Scores your password against 7 checks: 8+ characters, 12+ characters, uppercase, lowercase, numbers, special characters, and "not a common password or predictable pattern".
  • Compares your password with a built-in list of about 140 very common passwords and words, after undoing simple substitutions (@ for a, 0 for o, 3 for e, $ for s) and ignoring digits and symbols added at the ends - so Password1 and P@ssw0rd are treated as the common password they are.
  • Flags sequences (1234, abcd), keyboard walks (qwer, asdf), repeated characters and repeated blocks. Any of these lowers the level, and a recognized common password is always rated Very Weak.
  • Runs entirely in your browser with zero network requests - your password is never sent anywhere, logged, or stored. You can verify this yourself by disconnecting from the internet before typing.

Examples

"Password1" is rated Very Weak, not Good

Input

Password1

Result

Level: Very Weak, Score: 2/7, crack time "Instantly". Reason: matches or closely resembles a very common password.

Password1 has an uppercase letter, a lowercase letter, a number, and 8 characters, but it is the common password "password" with a capital letter and a digit, so the score is capped at 2 of 7.

"P@ssw0rd" is recognized through its symbol swaps

Input

P@ssw0rd

Result

Level: Very Weak. Reason: matches or closely resembles a very common password.

Replacing a with @ and o with 0 does not hide the word: the checker undoes common substitutions before comparing with its list.

A long random password scores high

Input

gT7#kP9$vL2@xQ8!

Result

Level: Very Strong, Score: 7/7. No warnings.

16 characters with every character type and no common word, sequence, keyboard walk, or repetition passes all 7 checks. The crack-time text is still just a fixed label for the score, not a computed figure.

Use Cases

Catching an obviously weak password

Too short, too simple, a common password with digits added, or a keyboard pattern all score low.

Checking a password meets a basic length-and-variety policy

The 7-check breakdown maps directly to typical "must contain uppercase/number/symbol" requirements.

Showing why complexity rules are not enough

Password1 and P@ssw0rd satisfy most complexity rules and are still rated Very Weak here.

Common Mistakes

Problem

Trusting a "Strong" or "Very Strong" result as proof a password is safe

Solution

The checker knows a limited list of common passwords and a few patterns. Personal information, dates, names, and passwords reused from other sites are not checked.

Problem

Using a common word with a number or symbol added

Solution

Summer2024!, Welcome1, and Admin@123 are recognized as variations of common passwords and rated Very Weak.

Problem

Treating the crack-time label as a real calculation

Solution

It's a fixed label per score level, not computed from entropy or an actual attack-speed model.

Problem

Expecting a breach check

Solution

The checker does not compare your password with data from known breaches.

Tips & Best Practices

Don't rely on a high score alone

Also ask yourself: is this a name, a date, or something about you that an attacker could guess?

Prefer length and true randomness over predictable complexity

A long random passphrase or a password-manager-generated password is safer than a short "complex" password.

Use a unique password for every account

A strong password that is reused across sites is only as safe as the weakest site that stores it.

Verify the local-only claim yourself

Disconnect from the internet, then use the tool - it still works, since nothing is ever sent over the network.

Limitations

Informational estimate only

The score is a rule-based estimate. It is not an entropy calculation and not a security guarantee.

A limited list of common passwords

The built-in list has about 140 very common passwords and words. A weak password that is not on the list and has no obvious pattern can still score well.

Crack time is a fixed label

The crack-time text is read from a lookup table keyed to the 0-7 score, not calculated from the password's character set or a stated attack-speed assumption.

No breach check

There's no HaveIBeenPwned-style check for whether a password has appeared in a known data breach.

No copy button, password generator, or history

You can show/hide the typed password, but there's no copy feature and nothing is saved between visits.

Comparisons

This Tool vs. a zxcvbn-Based Strength Estimator

Both give a strength rating, but a zxcvbn-style estimator models real-world guessing far more thoroughly.

This Tool (7-Point Checklist with Common-Password and Pattern Checks)A zxcvbn-Based Estimator
Detects predictable substitutions (P@ssw0rd)Yes, for common passwords on its built-in listYes, using large word lists
Dictionary sizeAbout 140 common passwords and wordsTens of thousands of words, names, and patterns
Entropy/crack-time basisFixed label per score levelCalculated from pattern analysis

FAQs

The most common question is whether the entered password is stored or sent anywhere. It isn't - everything runs in your browser using JavaScript, with no network requests made when you type. The score is an informational estimate: it recognizes common passwords, simple substitutions, and basic patterns, but it is not a security guarantee and it is not a substitute for a password manager and unique passwords.

Exactly how does this tool calculate the strength score?

It counts how many of 7 checks your password passes: 8+ characters, 12+ characters, contains uppercase, contains a lowercase letter, contains a number, contains a special character, and is not a common password or predictable pattern. The count (0-7) maps to a level from Very Weak to Very Strong. A recognized common password (including variations such as Password1 or P@ssw0rd) is always capped at Very Weak, and a sequence, keyboard walk, or repetition caps the level at Weak. It is an informational estimate - there is no entropy calculation, no zxcvbn library, and no breach lookup.

Does this tool catch predictable passwords like P@ssw0rd?

Yes, for passwords on its built-in list of about 140 very common passwords and words. The checker undoes simple substitutions (@ for a, 0 for o, 3 for e, $ for s) and ignores digits and symbols added at the ends, so P@ssw0rd, Password1, and Summer2024! are rated Very Weak. It cannot know every predictable password, so a result that is not flagged is not a guarantee of safety.

What makes a password strong?

Length is the most important factor - an additional character multiplies the attack space. A 16-character random password is exponentially stronger than a 10-character one. After length: character variety (uppercase + lowercase + numbers + symbols). After variety: unpredictability - avoiding dictionary words, names, dates, and predictable substitutions (P@ssw0rd is not strong in practice, despite meeting typical complexity requirements). This is general password-security guidance - this tool's own 7-point checklist doesn't check for predictable substitutions, so it will still rate a password like P@ssw0rd as "Strong."

Is my password sent to a server when I check it?

No - this tool runs entirely in your browser. The password is evaluated using JavaScript locally; no network request is made. You can verify this by disconnecting from the internet and opening the tool - it still works. Never enter passwords into online tools that send data to a server. A client-side strength checker like this one is safe to use with real passwords.

What is the recommended password length?

NIST SP 800-63B (2017, updated guidelines) recommends a minimum of 8 characters for human-generated passwords, but security professionals recommend 12–16 characters minimum for general accounts, and 20+ characters for high-value accounts (banking, email, password manager master password). Passphrases (4+ random words) like 'correct-horse-battery-staple' are both long and memorable.

What is the difference between password strength and password security?

Strength measures how hard the password is to crack by brute force or dictionary attack. Security also depends on: where the password is stored (is the site breached?), whether you reuse it across sites (one breach exposes all), whether you use two-factor authentication (adds a second layer even if the password is stolen), and whether the site hashes passwords correctly. A strong unique password + 2FA is genuinely secure.

Why do common complexity rules (uppercase + number + symbol) not guarantee strong passwords?

Rules like 'must contain uppercase, number, and symbol' were designed when computers were slow. Modern GPU-accelerated attacks can test billions of passwords per second. Common patterns - Password1!, P@ssw0rd, Summer2024! - are in real-world cracking dictionaries, even though this tool's own 6-word common-password list won't catch them. A truly strong password is random and long, not just complex. A random 12-character password of any mix is far stronger than a predictable 12-character 'complex' password.

Get more tools like this

Leave your email so we can prioritize similar tools and updates.

Related Tools

Report a Problem