Password Strength
Estimate password strength locally with length, variety and common-password checks.
Suggestions
Local heuristics only - this is not an official strength algorithm. Treat the rating as a rough reference.
How to use it
- Type a candidate password into the field - it is never sent anywhere and nothing is stored.
- The meter and the weak / fair / strong rating update as you type.
- Read the suggestions below the meter and adjust the password until the rating is strong.
- Tick Show password to check what you typed, useful on mobile keyboards.
Common use cases
- Before signing up anywhere - test a password idea before committing it to a new account.
- Improving an old password - see exactly which property (length, mix, symbols) your current one lacks.
- Security training - demonstrate to a team why
Summer2024!still scores poorly against leaked lists. - Personal policy design - find the shortest password shape you are willing to remember and type.
Why it stays private
The check runs entirely in your browser: length counting, regular expressions and a lookup in a small built-in list of common passwords. No input is transmitted, logged or remembered once you leave the page.
FAQ
Q: Is this an official strength algorithm? A: No. It is a set of local heuristics - length, character classes, a common-password list and simple patterns. Real attackers use different techniques, so treat the result as a rough reference, not a guarantee.
Q: Why did a long password still score low?
A: Length alone does not save a password that appears in leaked lists, or one built from a repeated character or a plain sequence like abcd or 1234. Attackers try those shapes first.
Q: Does typing here expose my password to the page? A: The password exists only in the page's own text field while you type. There is no network code in this tool, and clearing or closing the page discards it from memory.
Your data stays on this device
Password Strength runs 100% locally. Everything you paste or drop is processed by your own browser and never transmitted. Nothing is stored on our servers — close the tab and it is gone.
Nothing you type is sent to a server, logged, or used for analytics. The page works even with your network disconnected after first load.