Why are there two different crack times?

Because the honest answer depends entirely on how the site stores your password, and you have no way of knowing which. Against a login form that rate-limits, an attacker manages a few thousand guesses a second. Against a stolen database of fast unsalted hashes, a GPU rig manages ten billion. The offline figure is the one to plan around, because it is the one that applies after a breach.

Why does “P@ssw0rd!” score so badly?

Because symbol substitution is the first rule every cracking tool applies. Hashcat and John the Ripper both ship with rule sets that automatically try @ for a, 0 for o, 3 for e and so on against every dictionary word. Replacing letters with lookalikes adds essentially nothing while making the password much harder to type.

What actually makes a password strong?

Length, and being chosen at random rather than by a person. Four or five genuinely random words is both stronger and easier to remember than eight characters of punctuation. Better still, use a password manager: then every password is long, random and different, and you only have to remember the one that opens it.

Password Strength Checker

Type a password and see what it is actually worth — not a coloured bar, but the entropy in bits and how long it would survive two different attacks. Length, character variety, keyboard runs, repeated characters, trailing digits and lookalike-symbol substitutions are all accounted for, because each of those is something real cracking software exploits, and each one makes a password weaker than its raw length suggests.

Your text

Result

Nothing is uploaded — this tool runs inside your browser, so your files never leave your device.

Help us improve

Why use this tool

Reports entropy in bits, not a vague score out of five
Two crack times: a rate-limited login form, and a stolen database on a GPU
Detects keyboard runs, repeats, trailing digits and leetspeak substitutions
Runs entirely in your browser — the password is never transmitted

How it works

1Type or paste the password you want to test.
2Read the entropy and the two crack times.
3Act on the specific warnings underneath — they name what is weakening it.

Password Strength Checker — frequently asked questions

The checking is done in JavaScript in this page and nothing is sent anywhere — disconnect from the internet and it still works. That said, the safest habit is never to type a live password into any website. Test something with the same shape instead: same length, same pattern, different characters.

More developer tools

Text → Base64 Base64 → Text URL Encoder URL Decoder JSON Formatter JSON Minifier

Looking for something else? Browse all developer tools

Explore the other tools

Same deal everywhere on the site — free, no sign-up, and no watermark on anything you download.

QR Code Tools Barcode Tools PDF Tools Image Tools SEO Tools Text Tools Calculators Unit Converters Color Tools File Tools Business Tools AI Tools Utilities

Or see every tool on one page.