Strong Password Checker and Tester

Type a password to see a score out of 100, a verdict from Very weak to Very strong, and the exact reasons it lost points. The scoring rules are published in full below.

Runs in your browserFree, no sign-upLast reviewed October 8, 2026

Fill in the settings to see your result here.

Your result appears here instantly — nothing is uploaded.

Quick answers

What makes a password strong?: Length and unpredictability. A password of 16 or more random characters, or four or more unrelated words, is strong. One built from a common word, a name, a year or a keyboard run is weak however many symbols are added, because attackers try those patterns first.
How is the password score out of 100 calculated?: Up to 40 points for length (2 per character, full marks at 20), 10 points for each character type used, up to 20 points for estimated entropy (full marks at 100 bits), then 8 points off for each weak pattern found. The total is kept between 0 and 100.
Is it safe to type my real password into a password checker?: This one evaluates the password in your browser and makes no request with it. As a general habit, though, test a password before you start using it, or test one with the same structure, and never enter live passwords on a site you do not trust.
How long should a strong password be?: At least 12 characters, and 16 or more for email, banking and a password manager's master password. This tool deducts points below 12 characters and gives full length marks at 20. Current NIST guidance sets a 15-character minimum where a password is the only login factor.
Is a 12 character password strong enough?: Only if it is random. Twelve random characters using all four types score 80 here with about 78.7 bits of entropy. Twelve lowercase letters score 37, and twelve characters built from a name and a year are weaker in practice than any score suggests.
What score should I aim for?: 80 or more with zero weak patterns, which the tool labels Very strong. A score in the 60s or 70s with a pattern flagged, such as a year or common word, deserves less trust than the number suggests.

How Strong Password Checker works

This checker rates a password from 0 to 100 using four things: its length, how many of the four character types it uses (lowercase, uppercase, digits, symbols), an entropy estimate in bits, and a penalty of 8 points for each of seven weak patterns. Those patterns are: fewer than 12 characters, fewer than three character types, digits only, a character repeated three times in a row, a keyboard or alphabet run such as 123 or qwer, one of ten very common words such as password, and a year. The test runs inside your browser and the password is not sent anywhere. It is a rule-based estimate: it does not search breach databases or a full dictionary, and it gives no time-to-crack figure.

Password test results for well-known examples

Each row is the real output for that password. Do not use any of them: every password printed on a web page is in attackers' word lists.

Password tested	Score	Verdict	Estimated entropy	Weak patterns
123456	0/100	Very weak	19.9 bits	4
qwerty	0/100	Very weak	28.2 bits	4
password	10/100	Very weak	37.6 bits	3
iloveyou	10/100	Very weak	37.6 bits	3
abc123	14/100	Very weak	31 bits	3
letmein123	18/100	Very weak	51.7 bits	4
hunter2	25/100	Weak	36.2 bits	2
Password1	43/100	Moderate	53.6 bits	2
Summer2024	46/100	Moderate	59.5 bits	2
P@ssw0rd	58/100	Moderate	52.4 bits	1
MyDogRex2019	60/100	Strong	71.5 bits	1
Password2024!	67/100	Strong	85.2 bits	2
Tr0ub4dor&3	68/100	Strong	72.1 bits	1
correct horse battery staple	72/100	Strong	164 bits	1
x7#Kq2vLm@9Rz	83/100	Very strong	85.2 bits	0
G7m!xQ2v#Lp9wZ4t	92/100	Very strong	104.9 bits	0
G7m!xQ2v#Lp9wZ4tRb6y	100/100	Very strong	131.1 bits	0

Password2024! and MyDogRex2019 reach Strong on arithmetic alone even though both would fall quickly to a real attack. See the limits section below.

The scoring formula

score = min(40, 2 x length) + 10 x character types + min(20, entropy bits / 5) - 8 x weak patterns

Each part is rounded to a whole number and the final score is limited to the range 0 to 100. Entropy is length x log2(character pool), where the pool is 26 for lowercase, 26 for uppercase, 10 for digits and 32 for anything else, added together for the types present. Worked example for Kdmw9qhz!tyl: length 12 gives 24 points, four character types give 40, and 78.7 bits gives 16, with no patterns to deduct, for 80 out of 100. For password: 16 + 10 + 8 - 24 = 10.

How each change moves the score

The same random base, improved one step at a time.

Password	What changed	Score	Verdict	Estimated entropy
kdmwpqhzrtyl	12 lowercase letters	37/100	Weak	56.4 bits
KdmwPqhzRtyl	Added uppercase	50/100	Moderate	68.4 bits
Kdmw9qhzRtyl	Added a digit	68/100	Strong	71.5 bits
Kdmw9qhz!tyl	Added a symbol	80/100	Very strong	78.7 bits
Kdmw9qhz!tylWxn4	Lengthened to 16	92/100	Very strong	104.9 bits
Kdmw9qhz!tylWxn4Gv2p	Lengthened to 20	100/100	Very strong	131.1 bits

Reaching three character types removes the fewer-than-three-types penalty, which is why the third row jumps by 18 points.

Score bands and what they mean

Score	Verdict	Reading
80 to 100	Very strong	Long, varied and free of the patterns tested, or nearly so.
60 to 79	Strong	Acceptable on the numbers. Check the Weak patterns count before relying on it.
40 to 59	Moderate	Usually too short or built around a guessable element.
20 to 39	Weak	Short or drawn from one or two character types.
0 to 19	Very weak	Several weak patterns at once. Replace it.

The seven weak patterns the test looks for

Each one found costs 8 points and is named in the note under the results.

Shorter than 12 characters.
Fewer than three of the four character types.
Digits only.
The same character three or more times in a row, such as aaa or 111.
An alphabet or keyboard run: abc, bcd, cde, any three consecutive digits from 123 to 789, qwer, asdf or zxcv, in any letter case.
One of ten very common words, in any letter case: password, admin, welcome, letmein, iloveyou, qwerty, dragon, monkey, login, master.
A year: any four digits beginning 19 or 20.

What this password tester cannot tell you

The entropy figure assumes every character was chosen at random from the pool. People do not choose that way, so the figure is an upper bound. Password2024! contains all four character types and 13 characters, which earns 85.2 bits and a score of 67 even after two penalties. In practice a capitalised common word followed by a year and an exclamation mark is among the first shapes a cracking tool tries.

The word list is ten entries long, so ordinary dictionary words, names, places and song lyrics are not recognised. Letter swaps are not undone either: P@ssw0rd is flagged only for being short and scores 58. Spaces and accented letters count as symbols. And the tool has no access to breach data, so it cannot say whether a password has already leaked; a long random password that appears in a leak is unsafe on every site where it was reused.

Treat a high score as necessary, not sufficient. The reliable route to a password that is strong in fact is to let a password manager generate a random one for each account, turn on two-step verification, and memorise only the manager's master password.

Step by step

1
Type or paste a password into Password to check. The result updates as you type; the characters are visible on screen, so check who can see it.
2
Read Score and the verdict beside it: Very weak, Weak, Moderate, Strong or Very strong.
3
Look at Length, Character types, Estimated entropy and Character pool to see what the score is built from.
4
Check Weak patterns and the note underneath, which names every problem found.
5
Change the password, starting with making it longer, and watch which numbers move.

Frequently asked questions

Why did my passphrase lose points for character types?

Four lowercase words separated by spaces or hyphens use only two types, lowercase and symbols, so the fewer-than-three-types penalty applies. correct horse battery staple still scores 72 on length alone. Adding one capital letter or digit removes the penalty; the length is what does the real work.

What does estimated entropy mean?

It is a measure of how many guesses a blind search would need, written as a power of two. 40 bits means about a trillion possibilities; each extra bit doubles that. The estimate is only accurate for randomly generated passwords and overstates the strength of ones made from words or habits.

What is the character pool?

The number of different characters an attacker would have to try in each position, judged from the types you used: 26 for lowercase, 26 for uppercase, 10 for digits and 32 for symbols. A password using all four has a pool of 94.

Does this tool tell me how long my password would take to crack?

No. Time-to-crack figures depend on assumptions about the attacker's hardware and how the site stores passwords, and they vary enormously. The tool reports entropy in bits instead, which you can compare directly between two candidate passwords.

Does it check whether my password has been in a data breach?

No. Nothing is looked up, which is also why nothing leaves your browser. Only ten extremely common words are recognised. To check for exposure, use the breach monitoring built into your password manager or browser.

Can it validate a password against a website's rules?

Not specifically. It does not know a given site's minimum length or required characters. Character types tells you which of lowercase, uppercase, digits and symbols are present, and Length gives the count, which covers the rules most sign-up forms state.

Are symbols and capital letters worth adding?

They help a little; length helps more. Going from 12 to 16 characters added 26 bits in the table above, while adding a symbol to a 12-character password added about 7. Current NIST guidance tells services not to force character-type rules and to check passwords against known compromised ones instead.

Is the password I type stored or logged?

No. It lives in the page while the tab is open and is cleared when you close or reload it. The field shows the characters in plain view, so use the tool where nobody can read your screen.