Rate a password, show a checklist, and estimate offline brute-force time. Your password never leaves the page.
Estimates offline brute-force time at 1 billion guesses per second. Runs locally; your password is never sent anywhere.
What the password strength checker does
Type a password and see a strength rating, a checklist of what it includes, and a rough offline brute-force time estimate. The estimate assumes a fast attacker trying a billion guesses per second against a hash; a real online service rate-limits far below that.
Frequently asked questions
Is the estimate a guarantee?
No. It is a ballpark for a random password. Reused or leaked passwords are weak regardless of these numbers.
What makes a password strong here?
Twelve or more characters mixing upper and lower case, digits and symbols, with extra credit for length.
Is my password uploaded?
No. Checking happens in the page; it never leaves the device.
How to use it
- Type your password into the input field at the top of the page.
- Read the strength rating and checklist that appear below the field.
- Review the estimated offline brute-force time shown in seconds or years.
- Adjust your password if the rating is weak or the estimated time is too short.
Where it comes in handy
Use it when creating a new password for an account that requires special characters and digits. The tool shows immediately whether your combination meets common complexity rules before you submit the form.
It helps when evaluating an existing password against a target length of twelve characters. You can see at a glance whether adding symbols or extending the string raises the estimated cracking time above one year.
The calculator is useful for comparing two password candidates side by side. Enter each version and note which one pushes the brute-force estimate past the threshold your organisation demands.
Worth knowing
- The time estimate assumes a single hash checked at one billion guesses per second. A real attacker may try fewer candidates per second because of network latency or server-side rate limits.
- Passwords that appear in known leak databases are weak regardless of length. The checker does not compare your input against published lists of compromised strings.
- Length contributes more to the estimate than character variety. Changing “Password1” to “Password1!” adds roughly one additional character of entropy, but extending the base string to fourteen characters increases the estimate exponentially.