About the Strong Password Checker
This strong password checker scores a password out of 100 by combining its length, how many of the four character types it uses, an entropy estimate and a penalty for every weak pattern it recognises. It flags passwords under twelve characters, those using fewer than three character types, digit-only strings, any character repeated three or more times, keyboard runs such as qwer and asdf, words that sit near the top of every breach list, and embedded years. The password is examined by a pure function inside your browser tab: no request is made, nothing is logged, and nothing leaves the page.
How to use the Strong Password Checker
- 1
Type or paste the password into the Password to check field.
- 2
Read the Score out of 100 and the verdict beside it, from Very weak through to Very strong.
- 3
Check the Weak patterns count and the note underneath, which names each specific problem found.
- 4
Adjust the password — length first — and watch the score update as you type.
What people use it for
Auditing a password you already use
Paste an existing login to see whether it embeds a year, a keyboard run or a breach-list word you had not thought about, then decide whether it needs replacing.
Explaining password policy to a team
Watching the score jump as a password goes from ten characters to eighteen makes the length argument far more convincing than any written rule.
Choosing a master password
The one password you must memorise deserves proper scrutiny. Aim for a score above 80 with no weak patterns, built from several unrelated words.
Sanity-checking a generated password
Paste the output of any generator to confirm it reaches the entropy you expected before committing it to an account.
How the entropy estimate is calculated, and where it flatters you
The estimate infers a character pool from what the password contains — 26 for lowercase, 26 for uppercase, 10 for digits, 32 for symbols — sums the pools in use, and multiplies the base-2 logarithm of that total by the password length. It is the standard Shannon-style estimate, and it assumes an attacker who knows only which character classes you used. That assumption is generous. The figure treats Password2024! and x7#Kq2vLm@9Rz as equally strong at the same length, because both contain all four classes, when the first falls to a dictionary attack in seconds and the second does not. Real attackers do not enumerate the character space; they run rule-based attacks with tools like hashcat, applying capitalisation, leetspeak substitution, digit-suffix and year-suffix transformations to a wordlist of previously breached passwords. That is exactly why the pattern penalties sit alongside the entropy number: the deductions stand in, crudely, for the fact that a password matching a known human habit has far less real-world strength than the arithmetic suggests.
Uniqueness matters more than strength
The most common way an account is compromised is credential stuffing, not cracking. An attacker takes username and password pairs from one breached service and replays them across hundreds of others, because most people reuse. Against that attack, strength is irrelevant: a 30-character random string that appears in a breach dump is compromised on every site where you used it, while a mediocre password unique to one account survives. This is why current NIST guidance in SP 800-63B tells verifiers to check new passwords against a list of known compromised values and to abandon periodic forced rotation, which only pushes people towards small predictable increments. The practical conclusion is a password manager: it makes every password long, random and different without asking you to remember any of them, leaving exactly one password to memorise — the vault master password, which is the one worth real effort.
Tips
- Add characters before adding symbols; length raises the score and the entropy much faster than variety does.
- Four or five unrelated words strung together beat a short password with substitutions, and are far easier to type on a phone.
- Check whether a password has appeared in a breach at a service such as Have I Been Pwned — no strength score can tell you that.