How the estimate is calculated
The checker works out which character types you used and the size of that pool. A password of length L chosen at random from N characters has about L x log2(N) bits of entropy, and each bit doubles the guesses needed. Real passwords are rarely random, so the tool then finds the cheapest way an attacker could have built the text and lowers the number for what it sees:
- Repeats: runs such as aaaa, or a block repeated like abcabcabc.
- Sequences: runs such as abcd, 4321 or keyboard rows like qwerty.
- Common passwords: a short built-in list, including simple leetspeak such as p@ssw0rd.
- Words and years: recognised words count as one pick from a word list (about 10,000 to 32,000 words), not as random letters, and years count as one of about 130.
The rating comes from the final number: under 28 bits is very weak, 28 to 39 weak, 40 to 64 fair, 65 to 89 strong, and 90 or more very strong.
Worked example
Summer2024 naive 59.5 bits -> estimate 21.3 bits Very weak
(a word, a capital, a year)
Xk9$mP2#qL7! naive 78.8 bits -> estimate 78.8 bits Strong
(12 random characters from 95)
correct horse naive 164.7 bits -> estimate 10.8 bits Very weak
battery staple (a famous phrase)The naive figure only counts length and character types. The estimate is what remains after the patterns above are priced in. These figures are produced by the same code the tool runs and are checked by this site's automated tests.
Why this is only an estimate
- It cannot know about breaches. It does not check whether your password has appeared in a data breach. Doing so would mean sending something to a server, which this page never does. NIST recommends services check chosen passwords against breached and common password lists.
- Its lists are small. A password built from names, birthdays, pet names or song lines can be far easier to guess than shown.
- Guessing speed is an assumption. The time table uses two illustrative rates, 10 guesses per second against an online login and ten billion per second against a stolen database hashed with a fast algorithm. Slow hashing, lockouts and extra knowledge about you change real attacks a lot, so read the times as a comparison, not a prediction.
- It cannot know what you reuse. A strong password reused on several sites is only as safe as the weakest of them.
Use the result to spot obvious weaknesses, not as proof that a password is safe.
About privacy and testing real passwords
The text you type is processed in your browser by JavaScript on this page. It is not sent to a server and is not written to local storage or a cookie. Still, avoid typing a password you currently use for an important account into any website. Test a similar one with the same length and structure, or make a new one with the password generator.
Frequently asked questions
Is the password I type sent anywhere?
No. The analysis runs in your browser and the text is not transmitted or saved by this page. Extensions or a shared computer could still see what you type.
What is entropy in bits?
A measure of unpredictability. N bits means about 2 to the power N guesses to be certain of finding it, and on average half that. It is an estimate under assumptions about how the password was chosen.
Why does a long passphrase score lower than I expected?
Recognised words are counted as one pick from a word list, not as random letters, because attackers try word combinations. Words outside the built-in lists are counted the same way if they look like ordinary words, but unusual strings may be treated as random.
Does a high score mean my password is safe?
No. It means the checks found no weaknesses. A password can still be exposed by a breach, a phishing page or reuse across sites.
How are the guessing times worked out?
The average time is half of 2 to the power of the estimated bits, divided by an assumed guesses per second (10 online, ten billion offline). The rates are illustrations, not measurements of any real attacker.
What should I do if my password is weak?
Make it longer, remove words and patterns, and use a different password per site.