Password Strength Tester
Type a password below to see its strength score, entropy, estimated time to crack and detailed character analysis.
Reviewed by the ToolNestr Editorial Team — July 2026
Character Breakdown
How password strength is measured
Password strength is quantified using entropy — a measure of unpredictability expressed in bits. Entropy is calculated as E = L × log₂(C) where L is the password length and C is the size of the character set used (e.g., 26 for lowercase, 52 for mixed case, 62 for alphanumeric, 95 for all printable ASCII). Each additional bit of entropy doubles the number of possible passwords an attacker must try.
A password with 50+ bits of entropy is generally considered strong against brute-force attacks. However, entropy-based estimates assume uniform random selection — human-chosen passwords often have far less effective entropy than their length suggests due to patterns, dictionary words, and predictable substitutions.
Worked example
Crack time by password length
Longer passwords dramatically increase the time required to crack them. This assumes a mix of all character types (95 possible characters per position).
Security Conscious User
Tests passwords before using them on important accounts, ensuring each one meets strong security benchmarks.
System Administrator
Validates that user-chosen passwords meet organizational security policies and provides feedback for improvement.
Developer
Tests password strength algorithms and validates password validation rules during application development.
Compliance Officer
Ensures that organizational password practices meet regulatory compliance standards like GDPR, HIPAA, and PCI-DSS.
| Strength Level | Score | Entropy | Crack Time |
|---|---|---|---|
| Very Weak | 0–30 | < 28 bits | Instant |
| Weak | 30–50 | 28–35 bits | Hours |
| Fair | 50–65 | 36–44 bits | Days |
| Good | 65–80 | 45–59 bits | Years |
| Strong | 80–100 | 60+ bits | Centuries |
How to use Password Strength Tester
Type your password
Start typing a password in the input field. Analysis updates in real-time as you type.
Review the analysis
Check the strength score, entropy, crack time, and character breakdown. Review any issues listed below the analysis.
Improve if needed
Use the feedback to strengthen your password. Add length, more character types, and avoid identified patterns.
Tips for strong passwords
Length is everything
A 16-character password with only lowercase letters has 75 bits of entropy. An 8-character password with all character types has only 52 bits. Prioritize length over complexity.
Use a passphrase strategy
Combine 4-6 random words into a passphrase. "correct horse battery staple" style passwords are easy to remember but have high entropy due to length and unpredictability.
Never reuse passwords
Each account needs a unique password. If one service gets breached (and many will be), reused passwords give attackers access to all your accounts. Use a password manager.
What makes a password strong?
Password strength is determined by two factors: length and character variety. A strong password is long (12+ characters) and includes a mix of uppercase letters, lowercase letters, digits, and symbols. Each additional character exponentially increases the number of possible combinations an attacker must try. A 16-character password with all character types has more than 10^30 possible combinations.
Avoid common patterns like sequential characters (1234, abcd), keyboard walks (qwerty, asdfgh), personal information (birthdays, names, phone numbers), and common substitutions (p@ssw0rd). These patterns are the first things attackers try in dictionary attacks, often cracking them instantly regardless of length.
Entropy explained
Entropy is a measure of unpredictability measured in bits. Each bit of entropy doubles the number of attempts needed to guess the password. If a password has 40 bits of entropy, there are 2^40 possible combinations. The entropy depends on the size of the character set and the length of the password. A password using only lowercase letters has 4.7 bits per character, while one using all 95 printable ASCII characters has 6.57 bits per character.
The formula is: entropy = length × log₂(character set size). For a 12-character password using all 95 characters: 12 × log₂(95) = 12 × 6.57 = 78.8 bits. For reference, 80 bits of entropy is considered strong enough for most purposes. 128 bits is the security level equivalent to AES-128 encryption.
Brute force vs dictionary attacks
Brute-force attacks systematically try every possible character combination, starting from the shortest passwords. Their effectiveness depends entirely on the password's length and character set. Modern GPUs can attempt billions of hashes per second, making passwords under 10 characters trivially crackable regardless of complexity. Brute-force attacks are the worst-case scenario for attackers.
Dictionary attacks are far more efficient. They try common words, phrases, leaked passwords, and variations. These attacks crack most human-chosen passwords instantly because people tend to use recognizable patterns. A password like "Summer2024!" might seem strong but contains a common word and date pattern that a good dictionary attack would try in seconds.
Common patterns to avoid
Many seemingly clever password patterns are well-known to attackers. Avoid replacing letters with numbers (p@ssw0rd), adding a single digit or symbol to a base word (Password1!), using years or seasons (Spring2024), and keyboard patterns (qwerty123). Also avoid personal information — birthdays, pet names, and street names are easily guessed by anyone with basic information about you.
The most dangerous pattern is password reuse. When a site gets breached, attackers collect millions of email-password pairs. They then try these credentials on other popular sites (credential stuffing). Using a unique password for every account is the single most important security practice, and a password manager is the only practical way to achieve this.
Frequently asked questions
What makes a password strong?
A strong password is long (12+ characters), includes a mix of uppercase, lowercase, numbers and symbols, avoids dictionary words and patterns, and is unique to each account.
What is password entropy?
Entropy measures the unpredictability of a password in bits. Each bit doubles the number of possible combinations. A password with 50+ bits of entropy is considered strong against brute-force attacks.
How is estimated crack time calculated?
Crack time is estimated based on the password's entropy and assumes an attacker can attempt 1 billion hashes per second (typical for modern GPU-based attacks on fast hashes like MD5 or NTLM).
What is the difference between brute-force and dictionary attacks?
A brute-force attack tries every possible character combination. A dictionary attack tries common words, phrases, and variations. Dictionary attacks are much faster and crack most weak passwords instantly.
What common patterns should I avoid?
Avoid sequential characters (123, abc), keyboard patterns (qwerty, asdf), personal information (names, birthdays, phone numbers), common words (password, admin), and reused passwords from other sites.
Is a longer password always better?
Yes. Length is the single most important factor in password strength. Each additional character exponentially increases the number of possible combinations. A 16-character password is astronomically stronger than an 8-character one.
What does the character breakdown tell me?
The breakdown shows how many uppercase letters, lowercase letters, digits, and symbols your password contains. Using all four types significantly increases strength.
Is my password sent to a server?
No. All analysis happens entirely in your browser using JavaScript. The password never leaves your device.
Should I use a password manager?
Yes. A password manager generates and stores strong, unique passwords for every account. You only need to remember one master password.
What is the strongest type of password?
The strongest passwords are long (20+ characters), randomly generated, and include all character types. A randomly generated 20-character password with all types has over 120 bits of entropy.