Question 1

How is password strength measured (entropy)?

Accepted Answer

Strength is estimated using entropy — a measure of unpredictability in bits. We look at how long the password is and how large a character pool it appears to draw from (lower case, upper case, digits, symbols), then calculate roughly how many guesses an attacker would need. Each extra bit of entropy doubles that number, so longer passwords with more character variety score dramatically higher. The estimate assumes the password is otherwise random; predictable words or patterns make the real-world strength lower than the raw entropy suggests.

Question 2

What is a crack-time estimate?

Accepted Answer

The crack-time figure approximates how long an attacker would take to guess your password by brute force if they were checking around ten billion guesses per second — a realistic rate for an offline attack against leaked password hashes. It’s an order-of-magnitude guide, not a guarantee: a password that would take “centuries” to brute-force can still be cracked instantly if it’s a common word or appears in a breach list. Use the estimate to compare passwords, not as proof any specific one is safe.

Question 3

Does checking my password expose it?

Accepted Answer

No. This checker analyses your password entirely in your browser using local JavaScript — the characters are never transmitted, logged, or stored. You can verify this by turning off your network connection; the analysis still works. We deliberately avoid sending the password anywhere. If a tool ever needs to check a password against breach databases, the safe way is k-anonymity: only a short hash prefix is sent so the full password (or even its full hash) is never revealed.

Question 4

What are common password mistakes?

Accepted Answer

The big ones are reuse (the same password across multiple sites), using personal information (names, birthdays, pet names), short length, and predictable patterns like “Password1!” or keyboard runs such as “qwerty”. Simple character substitutions (“p@ssw0rd”) barely help because attackers’ tools already try them. Storing passwords in plain text or sharing them over chat or email also undermines even a strong password. The fix is a unique, long, random password per account, kept in a password manager.

Question 5

What should I do if my password is weak?

Accepted Answer

Replace it with a long, random password from a generator, store it in a password manager, and turn on two-factor authentication for that account. Prioritise your most important logins first — email, banking, and your password manager itself — since those protect or unlock everything else. If you’ve reused the weak password anywhere, change it on every site that shared it. Finally, check whether the account has appeared in a known breach, and if so, treat the old password as compromised everywhere it was used.

Password Strength Checker — Test Yours Safely

Weak password? Generate a better one.

Frequently asked questions

Related tools

Temporary Email

Encrypted File & Text
New

Encrypted Cloud Storage
New

Email Alias Generator
New