Two instruments for the one string that guards everything — a rule-by-rule checker and an entropy-based strength meter, both analyzing live as you type. Your password is processed locally and never leaves this tab.
An eight-rule pass/fail checklist for any password: length at 8 and 12, uppercase, lowercase, digits, symbols, a scan for common patterns ("password", "123456", "qwerty", single repeated characters) and an entropy reading. Green across the board means the password survives both policy checks and dictionary attacks.
Use it for policy validationsignup formssecurity auditsteam training
A continuous 0–100 strength score built on entropy (length × log₂ charset), plus the numbers that explain it: charset size, total combinations, and time-to-crack under two attacks — 10 billion guesses per second for a stolen-hash offline attack, 100 per second for a throttled online login. It ends with one concrete suggestion.
Use it for choosing passwordscomparing candidatespassphrase decisionsteaching entropy
Conventions · entropy = length × log₂(charset) · charset: lowercase 26 + uppercase 26 + digits 10 + symbols 33 · common patterns collapse the score · offline attack = 10¹⁰ guesses/s · online attack = 10² guesses/s · never type a real password into any website's demo — including this one
The privacy promise
Type anything. It never leaves this tab.
Password tools are the one place where privacy is not a feature — it's the whole point. This page has no backend and no database: every rule check, entropy bit and crack-time estimate is computed by JavaScript inside your own browser. Close the page and the password is gone for good.
YOUR PASSWORD→ANALYZED IN YOUR BROWSER→YOUR VERDICT
✕ SERVER · DATABASE · LOGS · ANALYTICS
Databasenull
Backendnone
Data uploads0
Session logs0
Questions
Asked often, answered plainly.
( 02 )
How is password strength calculated?
The core is Shannon-style entropy: length × log₂(charset size), where the charset counts lowercase (26), uppercase (26), digits (10) and symbols (33). The score maps that entropy onto 0–100, and collapses toward zero when the password contains a common pattern like "password", "123456" or a single repeated character — because attackers try those first.
What do the crack-time estimates mean?
They divide the total keyspace (2^entropy) by an attack speed. Ten billion guesses per second models an offline attack on a stolen hash with modern GPUs; one hundred guesses per second models a throttled online login. They are order-of-magnitude estimates, not guarantees — real attackers also use dictionaries and leaked-password lists, which is why common patterns are penalized so hard.
Is my password sent anywhere?
No. The analysis runs entirely inside your browser tab — the page has no backend and makes no requests with your input. Still, as a general habit, never type your real passwords into any website's demo tool, including this one; use the Sample button to play safely.
What is the difference between the checker and the meter?
The Strong Password Checker answers yes/no with an eight-rule checklist — great for validating against a policy. The Password Strength Meter gives a continuous score with entropy, combinations and crack-time estimates — great for understanding why a password is weak and how much longer or weirder it needs to be.