How to use this checker
The meter estimates how many guesses an attacker would need, and the generator builds a password from the character sets you allow. Nothing you type leaves the page.
- Type a password to check it, or open the generator tab to build one.
- Set the length first. Length raises the estimate faster than any other choice, because every extra character multiplies the search space.
- Choose character sets. Adding symbols and mixed case widens the space, but a long passphrase of ordinary words is often stronger and easier to remember than a short complex string.
- Read the entropy estimate and the crack time together, and treat both as rough comparisons rather than measurements.
- For anything important, generate the password here and store it in a password manager rather than memorising it.
A worked example: 12 lowercase characters vs 16 mixed
Twelve characters drawn only from the 26 lowercase letters has an estimated entropy of 12 × log2(26), which is about 56 bits. The page's crack-time figure assumes an offline attack at roughly 10 billion guesses per second and an average of half the keyspace, and it reports a large but finite number for that password.
Sixteen characters from the roughly 94 printable characters a keyboard offers is 16 × log2(94), about 105 bits. That is not merely safer; it is a different order of problem, because every additional bit doubles the work.
The gap between those two estimates is the entire argument for length. Going from 12 characters to 16 adds four characters, and four characters at 94 options each multiplies the search space by 94 to the fourth power — tens of millions of times more work, for a password you would not try to memorise anyway.
What your results mean
Entropy is an estimate of unpredictability, not a certificate. It assumes the characters were chosen at random. A 12-character password built from a dictionary word with a number on the end has 12 characters and far less real entropy, and this meter cannot see that — it only recognises a short list of famous passwords.
The crack-time estimate is a single scenario: a fast offline attack against a stolen hash. Online attacks are slowed by rate limits, and a well-built service also salts and stretches its stored hashes. The number is a comparison tool between two passwords, not a prediction about yours.
The composition rules this meter rewards are the ones federal guidance has moved away from. NIST's authentication guidance tells services to favour length, to screen passwords against known-breached lists, and not to rely on forced complexity as a substitute for either. Nothing here checks a breach list, and it should not: checking would mean sending your password somewhere.
The practical conclusion is unglamorous. One long random password per account, stored in a manager, beats a clever sentence reused everywhere, because reuse is what turns one breach into twenty.
Frequently asked questions
Is a longer password always stronger?
Longer is stronger when the characters are unpredictable. A long password made of a known phrase with predictable substitutions is weaker than a shorter random one. Length and randomness both matter.
How long should a password be?
Long enough that guessing is impractical, and that is easiest to satisfy with a manager-generated string. For anything you must type by hand, a multi-word passphrase of four or five random words is a reasonable compromise.
Is this password sent anywhere?
No. The check runs in your browser, and the generator uses the browser's secure random number generator. Nothing is transmitted or stored, which is also why the tool cannot check breach databases.
Should I change my passwords regularly?
Current federal guidance favours changing a password when there is evidence of compromise rather than on a fixed schedule. Forced periodic rotation tends to produce predictable variations of the same password.
Does two-factor authentication make this irrelevant?
No, but it helps a great deal. A second factor means a stolen password is not enough on its own. Use both: a strong unique password and a second factor where it is offered.
Why does the meter call my password weak?
Usually because it is short or drawn from a single character set, or because it appears on the built-in common-password list. The estimate assumes random selection, so it is generous to patterns it does not recognise.
Sources & references
The entropy estimate is this page's. The guidance it should be read against is NIST's.
Last updated: November 2, 2026. Reviewed by David Liu. Estimates only. Nothing you type is transmitted or stored.