Password Strength Checker

This checker inspects a password you type and scores it on a 0-4 scale from "Very weak" to "Very strong". It looks at length, the variety of character types used, repeated characters, and common weak patterns such as keyboard runs, dictionary words and years. It also produces a rough estimate of entropy -- a measure of how unpredictable the password is -- and gives specific suggestions for making it stronger.

Weak and reused passwords remain one of the most common ways attackers gain initial access to accounts and systems. Security teams use quick strength checks like this one to demonstrate to colleagues, students or clients what separates a genuinely strong password from one that only looks complicated, and to reinforce good habits during security awareness training.

Everything happens with plain JavaScript running in your browser tab. As you type, the tool checks the password against a series of rules (length tiers, character classes, repeated characters, known weak substrings) and combines the results into a score. The entropy estimate multiplies the password's length by the logarithm of the size of the character pool it draws from, which approximates how many guesses a brute-force attacker would need on average.

1. 1Type or paste the password you want to evaluate into the field above.
2. 2Use the eye icon to reveal or hide the characters as needed.
3. 3Read the strength meter and the pass/fail checklist below it.
4. 4Work through the recommendations to address the weakest points.
5. 5Re-test the improved password until it reaches a strong or very strong rating.

Weak: "password123" scores very low -- it contains a dictionary word, a predictable number sequence, and no special characters.

Better but risky: "P@ssw0rd!" looks complex but still contains a recognisable substitution of a common word, which pattern-matching attacks specifically target.

Strong: a random passphrase such as "correct-horse-battery-staple-42" is long, contains multiple word boundaries and a digit, and is not built from a single predictable pattern.

• Reusing the same password across multiple sites, so one breach exposes many accounts.
• Assuming adding a single symbol or digit to a weak base word makes it safe.
• Using personal information such as birthdates, pet names or addresses that attackers can find publicly.
• Choosing short passwords even when they mix character types -- length matters more than complexity.
• Storing passwords in plain text files, sticky notes, or unencrypted spreadsheets.

A strong individual password is only one layer of defence. Multi-factor authentication (MFA) protects you even if a password is stolen, guessed or leaked in a data breach. A password manager lets you use a unique, high-entropy password for every account instead of reusing memorable ones, removing the temptation to make trade-offs between security and convenience. Passphrases built from several unrelated words are often easier to remember than random strings while still being very long and hard to guess. This tool does not check whether a password has appeared in a known breach -- for that, consult a dedicated breach-checking service and never reuse a password once you learn it has leaked.