How to use the password strength checker
- Type or paste your password into the input field.
- The password strength checker instantly calculates Shannon entropy based on the character pool size and length.
- Pattern detection scans for dictionary words, sequential characters, repeated runs and keyboard walks, applying a penalty for each.
- Review the final score from 0 (very weak) to 4 (very strong) along with the breakdown of entropy and penalties.
- Adjust your password to increase length or character variety until you reach a satisfactory score.
How the score is calculated
The base metric is a search-space estimate in bits, not true Shannon entropy of how people choose passwords. The formula is H = L × log2(N), where L is the password length and N is the size of the character pool used. For example, an 8-character password using lowercase letters, uppercase letters and digits draws from a pool of 62 characters. Its base entropy is 8 × log2(62) = 47.6 bits.
This password strength checker then subtracts penalty bits for predictable patterns. Each word found in a small built-in list loses 20 bits plus 2 for every letter beyond four, so "password" loses 28 bits. A sequence like "1234" or "abcd" loses the larger of 2 bits per character and the cost of every character after the first. Repeated characters like "aaaa" are charged the same way, and keyboard walks such as "qwerty" lose at least 10 bits plus 2 per key. A password that is one short block repeated, such as "abcabcabc", is scored as the block alone. The adjusted entropy maps to a score: under 28 bits is 0, 28 to 35 is 1, 36 to 59 is 2, 60 to 79 is 3, and 80 or more is 4.
Entropy reference table
The table below shows approximate base entropy for different lengths and character pools, before any pattern penalties are applied. Use it to estimate how much length contributes to password complexity.
| Length | Lowercase only (26) | Mixed case + digits (62) | All printable ASCII (95) |
|---|---|---|---|
| 6 | 28.2 bits | 35.7 bits | 39.4 bits |
| 8 | 37.6 bits | 47.6 bits | 52.6 bits |
| 12 | 56.4 bits | 71.5 bits | 78.8 bits |
| 16 | 75.2 bits | 95.3 bits | 105.1 bits |
| 20 | 94.0 bits | 119.1 bits | 131.4 bits |
As a rough guide, aim for at least 60 bits of adjusted entropy for everyday accounts and 80 or more for sensitive ones.
Patterns that weaken passwords
High entropy alone does not guarantee security if the password follows a predictable structure. This tool checks four categories of patterns that reduce effective password complexity:
- Dictionary words: Common English words and frequent passwords like "admin", "letmein" or "dragon" are checked against a built-in list. Attackers try these first in dictionary attacks.
- Sequences: Runs of three or more ascending or descending characters, such as "abc", "321" or "xyz". These are trivially guessable.
- Repeats: The same character appearing three or more times consecutively, like "aaa" or "111". Repeats add almost no entropy.
- Keyboard walks: Adjacent keys typed in order on a QWERTY layout, such as "qwert", "asdfgh" or "1qaz2wsx". These are among the most common weak patterns.
Each detected pattern reduces the adjusted entropy, which can drop a seemingly long password from a high score to a low one.
Practical tips for stronger passwords
Length matters more than complexity rules. A 16-character passphrase made of random words often outperforms an 8-character string packed with symbols. If you need to generate random strings, use a dedicated password generator rather than trying to invent randomness yourself.
Avoid personal information like names, birthdays or pet names. These are easily discovered through social media and are included in targeted attack dictionaries. Similarly, do not reuse passwords across sites. A breach at one service exposes every account sharing that credential.
For maximum security, combine a long unique password with multi-factor authentication. You can also store credentials in a manager and protect them with algorithms like those found in a bcrypt generator when building applications.
Why local evaluation matters
Entering a real password into an online form that transmits data to a server creates a risk. Even over HTTPS, the plaintext exists momentarily in server memory or logs. This tool avoids that problem entirely by performing all calculations in JavaScript within your browser session.
No network requests are made. The dictionary list, pattern matching logic and entropy formulas are all embedded in the page. Because nothing is sent over the network, testing a password here does not expose it to this site, although anything you type can still be seen by software on your own device such as browser extensions.
Worked examples
| Example | Input | Result |
|---|---|---|
| Common word | Password: password | Score: 0 / 4 (Very weak); Base entropy: 37.6 bits; Pattern penalty: 28 bits; Adjusted entropy: 9.6 bits; Character pool: 26 |
| Leet speak | Password: P@ssw0rd | Score: 2 / 4 (Fair); Base entropy: 52.6 bits; Pattern penalty: 0 bits; Adjusted entropy: 52.6 bits; Character pool: 95 |
| Short random | Password: Tr5!kQ | Score: 2 / 4 (Fair); Base entropy: 39.4 bits; Pattern penalty: 0 bits; Adjusted entropy: 39.4 bits; Character pool: 95 |
| Passphrase | Password: correct horse battery staple | Score: 3 / 4 (Strong); Base entropy: 164.7 bits; Pattern penalty: 98 bits; Adjusted entropy: 66.7 bits; Character pool: 59 |
| Keyboard walk | Password: qwertyuiop | Score: 0 / 4 (Very weak); Base entropy: 47 bits; Pattern penalty: 66.3 bits; Adjusted entropy: 0 bits; Character pool: 26 |
FAQ
What does the score mean?
The score ranges from 0 to 4. The score is a rough label derived from adjusted entropy after pattern penalties: 0 means very easy to guess, 4 means the estimate is 80 bits or more. It is only an estimate from simple rules and cannot know how an attacker will actually guess.
Is my password sent to a server?
No. This password strength checker runs entirely in your browser. The password never leaves your device and no data is transmitted over the network.
Why does a long password get a low score?
Length increases base entropy, but predictable patterns like dictionary words, keyboard walks or repeated characters trigger heavy penalties. A 20-character password made of "aaaaaaaaaaaaaaaaaaaa" is scored as little more than a single character and ranks lower than an 8-character random string.
What is password entropy?
Entropy measures unpredictability in bits. It is calculated as the password length multiplied by the base-2 logarithm of the character pool size. Higher entropy means more possible combinations an attacker must try.
How does this compare to zxcvbn?
This tool is much simpler than zxcvbn. It combines a length-and-character-set estimate with a few pattern checks and a built-in list of only 42 common passwords and words. It does not know names, dates, most English words, or letter substitutions such as "p@ssw0rd", so a password built from them can score higher than it deserves. Use it as a quick sanity check, not as proof of strength.
What makes a password truly strong?
A strong password is long (at least 12 to 16 characters), uses a mix of character types, avoids dictionary words and personal information, and is unique to each account. Passphrases composed of unrelated random words are often both strong and memorable.
Should I use this for my actual passwords?
The evaluation happens locally in your browser and nothing is sent anywhere, but it is still safest to test a similar password rather than one you use today. If you suspect your password has already appeared in a data breach, its strength score does not matter: change it.