How Secure Is My Password?

Type a password to see how long it would take a computer to crack it, how many bits of entropy it has, and what makes it weak. The check runs entirely on this page: your password is never sent, saved or logged.

Free
No download or sign-up
Runs in your browser

Enter a password

Show

It would take a computer

–

to crack your password.

0bits of entropy

0characters

0of 4 character types

At least 12 characters
16 characters or more
Lower-case letters
Capital letters
Numbers
Symbols
No common words, sequences or dates

Want a password that scores "Very strong" every time? Use the strong password generator. It makes long, random passwords in your browser in one click.

How the crack time is worked out

The estimate assumes an offline attack: someone has stolen a database of password hashes and is guessing on their own hardware, at about 10 billion guesses a second. That is realistic for a powerful graphics-card rig against a fast hash. It is the worst case, and the one that matters after a data breach. On average, a password is found after trying half of all the possibilities, so the time shown is for half the search.

A simple count of characters would overrate many passwords, so the checker also looks for what attackers try first:

Common passwords such as 123456, qwerty and iloveyou, which are cracked instantly.
Dictionary words and names, including leet swaps like p@ssw0rd. Cracking tools try these substitutions automatically.
Sequences and keyboard patterns like abc, 1234 and asdf.
Years and dates, which are often birthdays.
The classic shape: a capital letter first, then a word, then a number or "!" at the end.

It is an estimate, not a guarantee. A password that has appeared in a data breach can be cracked instantly however random it looks, because attackers try leaked passwords first. Never reuse a password on more than one site.

What is password entropy?

Entropy measures how unpredictable a password is, in bits. Each bit doubles the number of guesses an attacker needs. A password with 40 bits needs about a trillion guesses to try every option; one with 80 bits needs about a trillion times more than that.

For a truly random password, entropy = length × log₂(number of possible characters). With all four character types there are about 95 characters to choose from, which gives about 6.6 bits per character, so a random 16-character password has about 105 bits.

Entropy	Time to crack at 10 billion guesses a second	Verdict
28 bits	Instantly	Very weak
40 bits	About 1 minute	Weak
50 bits	About 16 hours	Weak
60 bits	About 2 years	Fair
70 bits	About 19 centuries	Fair to strong
80 bits	About 2 million years	Strong
100 bits	About 2 trillion years	Very strong
128 bits	Far longer than the age of the universe	Very strong

How to make your password stronger

Make it longer. Length adds more strength than anything else. Aim for 16 characters or more.
Make it random. Avoid words, names, dates and keyboard patterns. The password generator does this for you.
Or use a passphrase: four or more random, unrelated words (not a quote or a lyric) are long and easy to remember.
Use a different password for every account, and keep them in a password manager.
Turn on two-step verification or use passkeys where you can, so a password alone isn't enough.

More advice in how to create a strong password.

Password strength FAQ

Is it safe to type my password into this checker?

The check runs entirely in your browser with JavaScript on this page. The password is not sent to any server, saved, or added to the web address. Even so, the safest habit is to test a password that is similar to yours rather than the real one.

How long does it take to crack an 8-character password?

A random 8-character password using all character types has about 52 bits of entropy, which takes from about a day to a few days at 10 billion guesses a second, depending on the symbols allowed. If it is a word with a number added, it can fall in seconds.

What is a good entropy for a password?

Aim for at least 75 bits for everyday accounts and 100 bits or more for email, banking and your password manager. A random 16-character password reaches about 105 bits.

Why does my password show "instantly" when it looks complicated?

Because it contains something attackers try first: a common password, a dictionary word with symbol swaps, a sequence or a date. Complexity that follows a pattern adds very little strength.

What does bits of entropy mean?

It is a measure of unpredictability. Each extra bit doubles the number of guesses needed, so a 60-bit password is about a thousand times harder to guess than a 50-bit one.

More tools

See all tools