Password Strength Test and Generator
Everything on this page runs inside your browser. Nothing you type is sent to us or to anyone else — open your network tab and watch.
Test a password
Type a password to test it
- Entropy
- —
- Offline crack time
- —
This exact password appears in the list of most-guessed passwords. Change it wherever you use it.
Crack time assumes an offline attack at 100 billion guesses per second against a fast hash. Compared against a bundled sample of 0 most-guessed passwords — this is not a breach database lookup.
Generate a password
Generate a passphrase
Word list bundled with this page: 0 short, unambiguous English words. Publishing the list costs nothing — the strength is in the random draw.
What actually makes a password hard to guess
Length beats complexity. A sixteen-character password of ordinary lowercase letters is harder to attack than an eight-character one crammed with symbols, because each additional character multiplies the search space while a substitution merely shifts it. This is why the old advice to add a capital, a digit and a punctuation mark produced a generation of passwords shaped like Summer2024! — which every cracking tool now tries early.
Reuse is the failure that matters most. When one site is breached, the exposed pairs are replayed against everywhere else automatically, so a strong password used in three places is a weak password three times over. A password manager plus a generated value per site removes that problem entirely, and the passphrase generator above exists for the two or three secrets you genuinely have to memorise.
None of this protects the network path between you and the sites you log into. If you sign in over a shared or public connection, SecureVPN encrypts that traffic, and our browser privacy audit shows what a site can still work out about your device once you are connected.
Questions fréquentes
Is it safe to type my password into this page?
This page never transmits what you type. There is no form submission, no network request carrying your input, and no analytics event containing the password or a hash of it — the only thing recorded is an anonymous counter noting that a check was run. You can confirm this yourself by opening your browser network tab while typing. That said, the safest habit with any password checker is to test a password of the same shape and length rather than the exact one you use.
How is password strength calculated here?
We start from the size of the character set you actually used and the length of the password, which gives a raw entropy figure in bits. We then subtract for structures that make a password predictable regardless of length: common passwords, dictionary words after undoing leet substitutions, three-or-more character repeats, sequential runs, keyboard walks, four-digit years, and the familiar "Capital, word, digits" shape. Every deduction is shown on screen with its cost in bits, so you can check the arithmetic.
What is a bit of entropy?
Each bit doubles the number of guesses an attacker needs. 40 bits means about a trillion possibilities, which sounds enormous but falls in seconds to hardware that tries a hundred billion guesses per second. Around 80 bits is where a password stops being worth attacking directly. The crack times on this page assume an offline attack at 100 billion guesses per second against a fast hash, which is deliberately pessimistic.
Does this check my password against breach databases?
No, and we will not claim otherwise. The page compares your input against a bundled sample of the most-guessed passwords for instant offline feedback. A genuine breach lookup means querying a service such as Have I Been Pwned, which would require sending data about your password off this page — the opposite of how this tool is built. If you want a breach check, do it deliberately on a service you trust.
Why are passphrases recommended?
A passphrase of several randomly chosen words is easier to remember and type than a random character string of equivalent strength. The strength comes entirely from the words being chosen at random by the machine, not from the word list being secret, which is why publishing the list changes nothing.
Are the generated passwords really random?
They use crypto.getRandomValues, the browser cryptographic random source, with rejection sampling so no character is more likely than another. The generator also guarantees at least one character from each type you enable and then shuffles, so the result satisfies password rules without a predictable layout.