Password Strength Checker
Estimate password strength from length and character variety — computed entirely in your browser, never sent anywhere.
Strength
Strong
- Score (0–100)
- 84
- Length
- 11
- Character types used
- 4
Updates live as you type
Frequently asked questions
It is a heuristic based on length and how many character types you use (lowercase, uppercase, digits, symbols). Longer and more varied passwords score higher.
No. The calculation happens entirely in your browser and nothing is transmitted, stored or logged. Still, avoid typing your real, active passwords into any website.
Not necessarily. This does not check breach lists or detect common words and patterns, so a high score is not a security guarantee.
Length above all, plus randomness. A long passphrase of unrelated words, or a manager-generated string, beats a short complex one. Never reuse passwords across sites.
Dropping two character types costs more than dropping two characters
"Tr0ub4dor&3" — 11 characters, all four character classes (lowercase, uppercase, digits, a symbol) — scores (11 × 4) + (4 × 10) = 44 + 40 = 84 out of 100, labelled "Strong." Strip it down to a plain "Troubador" — 9 characters, only lowercase and one capital, so 2 character classes — and the score drops to (9 × 4) + (2 × 10) = 56, still "Moderate" but noticeably lower. Losing 2 characters cost little; losing 2 character classes cost a lot more — variety pulls its own weight in this heuristic, separate from length.
What the score is actually measuring
This checker reads two things: length, and how many distinct character types are present — lowercase, uppercase, digits, symbols. More of either pushes the score, and the label (Weak → Moderate → Strong → Very Strong), higher. It's a heuristic, not a lookup against real-world password data.
What never leaves the browser, and what still should be avoided
Everything runs locally: nothing is sent over the network, stored or logged. Still, avoid entering real, in-use passwords into any website, including this one — test a similar pattern instead of the actual password.
Important: this is a rough estimate based on length and character variety, not a security audit. It doesn't check breach databases or catch common words, keyboard walks and predictable substitutions, so a high score here is not a guarantee of real-world safety. For actual security, length and randomness matter more than this heuristic can capture — a long passphrase of unrelated words, or a password-manager-generated string, beats a short, fiddly one, and using a unique password per account means one leak never unlocks the rest. Use this to build intuition about what makes passwords stronger or weaker, not as the only line of defence against a real attack.