Search
Dark Mode

Tools / Password Tools

Password Generator & Checker

Generate strong passwords and check how strong an existing one really is.

Password Generator

Generate a random, cryptographically secure password with a customizable length and character set.

Excellent

Password Strength Checker

NIST SP 800-63B · OWASP

Evaluate password strength based on length, estimated cracking resistance, and predictable patterns.

Enter a password to check its strength.

Password characteristics

  • ○ At least 12 characters
  • ○ Contains an uppercase letter
  • ○ Contains a lowercase letter
  • ○ Contains a number
  • ○ Contains a symbol

For information only: these characteristics do not determine the overall strength rating.

Your password never leaves your device.

Password security FAQ

Common questions about password strength, privacy, and how our checker works.

How is my password strength calculated?
Your password is evaluated using four independent checks: estimated crack time, password length, whether it looks like an email address, and whether it matches a known leaked password pattern. Crack time and length are combined into a weighted score, while an email-like format or a leaked-password pattern caps the rating regardless of the rest.
Why can a long password still be rated Weak?
Length alone does not guarantee security. A long password can still contain a known leaked password, a predictable sequence, or another easily recognizable pattern. Our assessment considers several independent signals rather than length alone.
Why does my password show a long crack time but still get a low rating?
The crack-time estimate reflects the password as a whole. Our rating also checks for specific weaknesses, such as a known leaked-password pattern. A weakness in one of these checks can cap the overall rating even when the crack-time estimate is high.
What are "Detected patterns"?
Detected patterns are recognizable parts of your password, such as dictionary words, common passwords, sequences, keyboard patterns, repetitions, or dates. These patterns make a password easier for an attacker to guess.
Is my password sent to a server?
No. Password analysis runs entirely in your browser. Your password is never sent to our servers, stored, logged, or transmitted to any external service.
Do uppercase letters, numbers, and symbols make my password secure?
Not by themselves. These characteristics add variety, but they don't guarantee resistance to guessing. A long password containing predictable or commonly used patterns can still be weak.
What makes a password strong?
A strong password is long, hard to predict, and free of commonly used or leaked patterns. Using a unique password for each account, ideally generated and stored with a password manager, is the most reliable approach.