See how strong a generated password is. Live entropy in bits and an estimated crack time update as you change the settings.
✓ Web Crypto randomness
↗ Runs in your browser
∞ Free, no account
Very strong103 bits · ≈ centuries at 10 billion guesses/sec
Generated on your device with the Web Crypto API. Nothing is sent or stored.
Space / Enter regenerates · Focus the password and press Ctrl/Cmd+C to copy
WHY USE IT
Understand exactly how strong your password is
The meter under the password shows its entropy in bits and an estimated time to crack it at 10 billion guesses per second. Change the length or character types and watch the numbers move, so you can pick settings that are strong enough for each account.
Entropy shown in bits for every setting
Estimated crack time at 10 billion guesses per second
Four-step meter from Weak to Very strong
Updates instantly when you change length or characters
Calculated locally; nothing is sent anywhere
Compare random passwords, passphrases and PINs
HOW TO USE IT
Password Strength Checker in three steps
1
Adjust the settings
Change the length slider and toggle character types to see how each choice affects strength.
2
Read the meter
Check the label and the bits. Aim for “Strong” (70+ bits) at minimum and “Very strong” (100+) for key accounts.
3
Generate and copy
When the meter is where you want it, copy the password into your password manager.
How password strength is calculated
For a randomly generated password, entropy is the length multiplied by log2 of the number of possible characters. A 16-character password from a 94-character pool has 16 × 6.55 ≈ 104 bits.
Crack time estimates assume an attacker testing 10 billion guesses per second, which is realistic for a well-equipped offline attack on a fast hash. On average an attacker finds the password after searching half of the possibilities.
What the strength labels mean
Weak (under 25 bits): can be guessed almost instantly.
Fair (25–44 bits): only acceptable where attempts are strictly rate-limited.
Good (45–69 bits): reasonable for low-value accounts.
Strong (70–99 bits): suitable for most accounts.
Very strong (100+ bits): recommended for email, banking and password managers.
Limits of any strength meter
Entropy figures are only accurate for passwords that are truly random. A password you invent yourself may look long but follow patterns that attackers guess early, so its real strength can be far lower than a simple calculation suggests.
No meter can tell you whether a password has already leaked in a breach. Use a unique generated password for every account and check exposure with a service such as Have I Been Pwned.
MORE FREE TOOLS
Pick the right generator for the job
Use a unique secret for every account and store it in a reputable password manager.
Entropy measures how unpredictable a password is, in bits. Each extra bit doubles the number of guesses needed to find it.
How many bits should my password have?
At least 70 bits for everyday accounts and 100 or more for email, banking and your password manager.
Can I check a password I already use?
This tool rates the passwords it generates. We deliberately don’t ask you to type existing passwords into a website; generate a new strong one instead.
Why does adding symbols increase strength?
Symbols enlarge the pool of possible characters, so each character carries more entropy.
Is the crack time estimate exact?
No. It is an estimate based on a fixed guessing speed. Real attacks vary, but the relative comparison between settings is what matters.
Is anything sent to a server?
No. All calculations happen in your browser.
Ready for a password you can trust?
It takes one click, and it never leaves your browser.
