Password Strength Checker
Test how strong your password really is with real entropy math, leaked-password matching, and pattern detection — free, private, nothing ever leaves your browser.
Password Strength Checker scores any password using real entropy math and flags common weaknesses: exact or leetspeak matches against leaked-password lists, keyboard-row patterns, sequential runs, and repeated characters. It shows estimated crack times for three real attack scenarios and gives specific suggestions to fix it. Nothing is ever sent to a server. Built by FreeToolHub.
Never sent anywhere, never stored — checked entirely on your device.
Start typing to see your password strength.
Estimated time to crack
Estimates based on published guessing-speed benchmarks — real attack speed depends on the attacker's hardware and hashing algorithm used.
Suggestions
Frequently Asked Questions
Does this tool store or send my password anywhere?
No. Everything runs locally in your browser using JavaScript. Your password is never sent to any server, never logged, and never stored — not even temporarily. It only exists in the input field while you type, and disappears the moment you leave or refresh the page.
How is the strength score calculated?
The tool calculates the theoretical entropy of your password based on its length and character variety, then applies penalties for real-world weaknesses: an exact or leetspeak match against a list of the most commonly leaked passwords, keyboard-row patterns like qwerty, sequential runs like abcd or 1234, and repeated characters. The final score reflects how guessable the password actually is, not just how long it looks.
What do the crack time estimates mean?
The tool shows three scenarios: an online attack throttled to about 100 guesses per hour by the target service, an offline attack against a slow, properly salted hash like bcrypt, and an offline attack against a fast hash using modern GPU hardware. These are estimates based on published guessing-speed benchmarks, not a guarantee — real attack speed depends on the attacker's hardware and the exact hashing algorithm used.
Is a long random password always the strongest?
Length matters more than any other single factor, but not all long passwords are equal. A long passphrase built from unrelated random words is strong, while a long password that repeats a short pattern or uses only one character type scores lower here, because that structure makes it far more guessable than its raw length suggests.
Should I test my actual real password here?
Yes, it is safe — nothing leaves your browser. If you would still rather not, you can test a password with the same length and character mix instead; the score will be nearly identical. Either way, always use a unique password per account and consider a password manager.
What's the difference between this and the Password Generator tool?
This tool checks a password you already have or are thinking of using. The Password Generator creates a brand-new, cryptographically random password for you from scratch. If this checker rates your password poorly, the Password Generator is the fastest way to replace it with a strong one.