UtilibyWritten by the Utiliby editorial team · Last updated October 14, 2026 · Rules and formulas reviewed October 2026
What this free password strength checker does
Most password meters only count letters, numbers and symbols, which is why they rate Password1! as strong when attackers crack it in seconds. This free online password strength checker takes a different approach. It estimates how many guesses a real attacker would need, using the way cracking tools actually work: common passwords first, then words and look-alike swaps, then keyboard runs and dates, and only then random characters.
You get a clear verdict, a strength bar that moves as you type, a breakdown of the parts an attacker would notice, and the estimated time to crack under five attack speeds, from a rate-limited login form to a large GPU cluster attacking a leaked hash. Tips explain what to fix. Everything runs in your browser, and your password is never sent or stored.
How to use the password strength checker
- Type or paste a password. Use the show option if you need to see what you typed.
- Read the verdict. The bar and the label show the overall strength.
- Study the breakdown. Each block is a part that an attacker's tool would match, such as a common word or a sequence.
- Check the crack times. Compare the rate-limited online case with the fast offline cases.
- Follow the tips. Lengthen, remove patterns and use unrelated words.
For important accounts, test a similar password instead of the real one, or press the random test password button to see what a strong one looks like.
How strength is estimated
The checker splits your password into the cheapest set of parts an attacker could guess, and adds up the work. A part can be a very common password, a common word, a sequence such as abc or 321, a keyboard run, a repeated character, a year or a date. Each has a cost in guesses. Anything left over is treated as random characters from the sets you used, lowercase, uppercase, digits and symbols.
The total is shown in bits. Each bit doubles the guesses needed, so 40 bits is about a trillion guesses and 80 bits is far beyond any real attack on a slow hash. Look-alike swaps and capital letters add a small cost because attackers apply those rules automatically. This is why the checker gives credit for length and randomness, and very little for predictable tricks.
Understanding the crack-time table
| Attack | Speed assumed | What it means |
|---|---|---|
| Online with limits | about 100 tries per hour | A site that locks or slows repeated failures |
| Online, no limits | 10 per second | A poorly protected login form |
| Offline, slow hash | 10 thousand per second | A stolen database hashed with bcrypt or Argon2 |
| Offline, fast hash | 10 billion per second | A stolen database hashed with MD5 or SHA-1 |
| Large GPU cluster | 1 trillion per second | A well-funded attacker on a fast hash |
The time shown is the average, which is half of the time to try every possibility. You rarely know how a site stores your password, so plan for the offline rows. A password that holds up there is safe in almost every real case.
Patterns that weaken a password
- Common passwords. Lists of leaked passwords are tried first. Anything on them falls in moments.
- Words and names. Single words, pet names, teams and places are in every cracking list.
- Look-alike swaps. Changing a to @ or o to 0 is on every attacker's rule list.
- Keyboard walks and sequences. Examples are qwerty, asdf, 123456 and abcdef.
- Dates and years. Birthdays and years are a small space to search.
- Repeats. Doubling a short password adds little.
- Personal facts. Names, addresses and phone numbers from social media are tried in targeted attacks.
How to make a strong password
The best approach is to let a password manager generate a random password of at least 16 characters for each account. When you need one you can remember, such as for the manager itself or a device login, use a passphrase: four or five random, unrelated words. Randomness matters, so pick the words by chance and not from a favorite phrase, a song or a quote. Our Passphrase Generator can create one for you.
Never reuse a password. When one site is breached, attackers try the same email and password on other services, which is called credential stuffing, and reuse is the main way one leak becomes many.
Common password myths
- Complex is always better. A long plain phrase of random words beats a short string of symbols.
- Change it every 90 days. Guidance now favors changing it when you suspect exposure.
- Writing a password down is always bad. A paper note kept at home can be safer than reusing a password online, though a manager is better still.
- My accounts are not interesting. Attacks are automated and target everyone.
- A strong password is enough. Add two-factor authentication.
What to do after you check
If the result is weak, change it at once and make the new one longer and unique. If your password has ever been in a breach, treat it as public and replace it wherever you used it. Turn on two-factor authentication for email, banking and anything that can reset other accounts. Review recovery email addresses and phone numbers, since an attacker can use them to take over an account even with a strong password. Check this site's Breached Password Checker and 2FA Code Generator for those steps.
Matching password strength to the account
Not every account needs the same protection, but the accounts that can reset other accounts need the most. Your email is the key to all the rest, because password reset links go there. Use the table as a guide.
| Account type | Suggested minimum | Extra protection |
|---|---|---|
| Email, password manager, banking | 16+ random characters or 7+ random words | Two-factor app or hardware key |
| Work, cloud storage, social media | 14+ characters, unique | Two-factor authentication |
| Shopping and subscriptions | 12+ characters, unique | Two-factor if offered |
| Low-risk forums and newsletters | 12+ characters, unique | None needed |
The word unique matters as much as the length. A long password reused on a careless site is only as safe as that site. Let a password manager handle the variety, so strength costs you no effort.
Why the same password can score differently here and elsewhere
Strength meters disagree because they use different models. A meter that counts only character types will score a long, common phrase highly, while one that models guessing will not. This checker uses the guessing approach, so a password such as a famous quote scores low even though it is long, and a random string of the same length scores high. The estimate also depends on the word lists built into the page. A rare word, a name from your own life or a mix of two languages may be guessed more easily by someone who knows you than the score suggests, so personal details should never be part of a password. Treat the number as a floor on your worry and not as a promise of safety.
Privacy, limits and responsible use
The analysis runs in your browser with no network request, and nothing is saved. The report you can print or download never contains your password. The estimate is only as good as its model: words that are not in the built-in list are scored as random letters, and real attackers also use personal information that no tool can see. Use the result as a guide and not as a promise.
Frequently asked questions
How do I check if my password is strong?
Type it into the box. The checker estimates how many guesses an attacker would need, shows the time to crack under five attack speeds, and lists patterns that make it weaker.
Is it safe to type my password here?
The check runs in your browser and nothing is sent, saved or logged. Still, a good habit is to test a similar password, not the exact one for an important account.
What makes a password strong?
Length, randomness and uniqueness. A long password made of unrelated words or random characters, used for one account only, is far stronger than a short one with symbols.
How long should a password be?
At least 12 characters, and 16 or more for important accounts. Each extra character multiplies the work for an attacker.
Are symbols and numbers required?
They help only a little if the rest is predictable. Adding length is usually better. A phrase of four or five random words is easy to remember and hard to guess.
What does time to crack mean?
It is the average time to find the password by guessing, at a stated speed. Online attacks are slow because sites limit tries. Offline attacks on a stolen hash can be billions of guesses per second.
Why are there five speeds?
Real attackers differ. A login form with limits is slow to attack. A leaked database with weak hashing is fast. The slowest rows show best-case security, and the fastest rows show worst-case.
What is a bit of strength?
Each bit doubles the number of guesses needed. A password with 40 bits needs about a trillion guesses, and one with 80 bits needs a trillion trillion.
Why is P@ssw0rd weak?
Attackers know the common swaps, such as @ for a and 0 for o. They try them automatically, so the swaps add almost nothing.
What is a keyboard pattern?
A run of neighboring keys such as qwerty or asdf, or numbers in order such as 12345. They are among the first guesses tried.
Should I change my password regularly?
Current guidance from security bodies says to change a password when it may be exposed, not on a fixed schedule. Forced changes tend to lead to weaker, predictable passwords.
What is a password manager?
An app that creates and stores a different strong password for each account behind one strong master password. It is the practical way to use unique passwords.
What if my password was in a data breach?
Change it everywhere you used it, and use a unique new one. Check the Breached Password Checker on this site to see whether it appears in known leaks.
Does this tool know my real strength?
It gives an estimate. It cannot know an attacker's exact lists, and words missing from its small built-in list are scored like random letters, so real strength may be lower.
What is two-factor authentication?
A second proof of identity, such as a code from an app, in addition to your password. It protects the account even if the password leaks.
Can I print or save the result?
Yes. Print / save summary and Download report include the length, character types, score and crack times. They never include the password itself.
Is it really free?
Yes. It is free to use online, with no sign-up and no limits.
Sources and further reading
- NIST Special Publication 800-63B, Digital Identity Guidelines (nist.gov), for password length and change guidance.
- OWASP Authentication Cheat Sheet and Password Storage Cheat Sheet (owasp.org).
- UK National Cyber Security Centre, Password guidance and the three random words approach (ncsc.gov.uk).
- Dropbox, zxcvbn: realistic password strength estimation, for the pattern-matching method.
- Have I Been Pwned, Pwned Passwords documentation (haveibeenpwned.com).
Sources were consulted in October 2026. Standards and rules can change, so always check the official page for your situation.