Password Strength Checker

What a strength score really tells you

A meaningful strength check is not just "does it have a capital, a number and a symbol". It estimates how long a password would survive a determined guessing attack by looking at its length, its true randomness, and whether it matches patterns attackers already know about. That last part is what most naive checkers miss.

Why complexity rules lie to you

"P@ssw0rd1" satisfies almost every corporate complexity rule, yet it is one of the first things any cracking tool tries. Attackers know the predictable substitutions - "a" to "@", "o" to "0", a "1" on the end - and bake them into their rules. A password can tick every box on a sign-up form and still be trivially weak, which is exactly why a real checker looks past the rules at the underlying predictability.

How passwords are actually broken

When a site is breached, attackers rarely guess against the live login. They steal the hashed password database and attack it offline, where modern hardware tries billions of candidates per second - running through dictionaries, leaked password lists, and rule-based mangling before ever resorting to brute force. Your defence is length and genuine randomness, which push the time-to-crack beyond anything practical.

A safety note

As a habit, do not paste a password you currently use into any online checker. This tool analyses everything locally in your browser and sends nothing anywhere, but treating that as the rule everywhere protects you on sites that are not so careful. If a check here comes back weak, the fix is almost always the same: make it longer, make it unique, and let a password manager remember it.