Password strength checker
A person types a password and learns two different things about it: how quickly a cracker who exploits human habits would guess this password, and how strong a password of this shape would be if a generator had produced it, and is told which of the two answers applies to them.
Length must be 1 to 128.
Neither number is a security guarantee. Both are outputs of a named model under a stated assumption.
This figure is this page's own arithmetic: length × log2(character set size). zxcvbn-ts is not used for it.
This page does not know where your password came from, so it scores it the way an attacker must: against the whole 94-character printable-ASCII space. /dev/password-generator does know - it knows the alphabet it drew from - so it reports fewer bits for the very same password. Both numbers are right, because they answer different questions.
0 third-party scripts on this page
KB figures are compressed transfer size, not decoded size.
This page does not make passwords.
- Guessability
- ·
- Shape entropy
- ·
- Length
- ·
- Requests
- · from Resource Timing
- Script
- · KB of a 100 KB budget
Why one number would be a lie
Entropy is a property of the process that produced a secret, not of the string it produced. Nothing looking at the characters can tell the two cases apart.
Take a passphrase of four words joined by hyphens. Drawn at random from a 2,048-word list, it is 44 bits and perfectly respectable. Typed by a person because they read the famous comic about it, it is worth close to nothing, because that exact string has been in every cracking wordlist for over a decade. Identical characters, identical length, identical character classes. One is fine and one is already broken.
The generated figure is an upper bound and is correct only when a generator really did the work. The second figure estimates how many guesses a pattern-aware attacker may need. It is produced by zxcvbn-ts, an MIT-licensed maintained engine, and remains a model rather than a measurement of the password's entropy. The matcher does not always split a passphrase on every space, so the "Why the score fell" list can name fewer words than you typed. It does not invent the missing ones.
What the chosen estimate looks for
A dictionary word is worth roughly the logarithm of the wordlist, not its length. An attacker guesses words, not letters, so an eight-letter word from a common list is about eleven bits rather than the thirty-seven its length implies.
Replacing letters with lookalike digits is the first rule every cracking tool applies, so it earns about two bits rather than the twenty it appears to. A trailing year is worth under seven bits, because there are about a hundred plausible ones. Capitalizing only the first letter is what almost everyone does. Keyboard runs, repeated characters and straight sequences are all in the standard wordlists.
The local engine also checks its official common-password corpus and keyboard graphs. Finding no familiar structure is still not proof of randomness: real attackers use breach corpora, regional dictionaries, and rules no browser bundle can completely reproduce.
What to do with the number
Under 40 bits, assume it is already crackable if a database holding it is ever stolen. Between 40 and 60, it survives an unsophisticated attack and not a determined one. Above 70 bits, an offline attack stops being the thing to worry about, and the realistic risks become reuse across sites, phishing, and the password being in a breach somewhere with your email next to it.
Those last three are not measurable from the characters, and they are how most accounts are actually lost. A strong password used in two places is weaker than a mediocre one used in one.
Questions
Is my password sent anywhere?
No. The estimate is computed in this tab by a script that makes no requests, the page keeps working with the network off once it has loaded, and a build-time test fails the release if that ever changes. Despite all of that, the advice above the box stands: type a variation rather than the real thing, because the habit of pasting real passwords into web pages is what eventually gets somebody caught out on a page that is not this one.
Why does it rate my password lower than another checker did?
Because most of them report only the generated figure, which is the flattering one. A twelve-character password made of a name and a year scores well on length and character variety and is on the first page of any real attacker's list. The second number here is what that password is actually worth.
Does it check whether my password has been in a breach?
No, and that is a deliberate omission rather than a missing feature. Every service that does this works by sending a partial hash of your password to a remote API. The well-designed ones are careful about it and it is still a request leaving your machine carrying information about your password, which is the one thing this site does not do. Use a password manager's built-in check, where that request is part of a tool you have already trusted with everything.
What counts as a good score?
For anything a password manager types, aim for the generated figure to be over 100 bits, which takes sixteen random characters from a full mixed alphabet. Twelve reaches about 79, not 100. For something you type yourself, use a password manager-generated passphrase rather than relying on a character-based score for something you invented.
Why does length matter more than symbols?
Because entropy is length multiplied by the logarithm of the alphabet. Adding symbols grows the alphabet this page assumes from 62 to 94, which is worth about six tenths of a bit per character. Adding one more character is worth six and a half. Every extra character multiplies the search space; every extra character class only widens it slightly.
Related tools
If the answer is that yours is too weak, the password generator makes one with the entropy printed, and the passphrase generator makes one you can actually type. Generating either in this tab is the subject of is it safe to use an online password generator. To fingerprint a value rather than judge a secret, use the hash generator. Is it safe to use an online password generator is the article that cites this checker.