Type a password to get its entropy in bits and a strength rating — computed entirely in your browser, never sent anywhere.
What Is Password Strength Checker
A password strength checker measures entropy: a 12-character password using all four character classes (pool 94) has 12 × log₂(94) = 78.66 bits, rated “Strong” by this tool’s bands (under 40 Weak, 40–60 Fair, 60–80 Strong, 80+ Very Strong).
How to Use
- Type the password.
- Click “Check Strength” for entropy and rating.
Formula
Entropy = length × log₂(pool). Pool = 26/26/10/32 per class present.
Worked Example
“Tr7$kQ9!mZ2@” — 12 chars, all 4 classes (pool 94): 12 × 6.555 = 78.66 bits → Strong.
How It Works, In Plain Words
Entropy is a way of counting how hard a password is to guess, expressed in “bits”. The checker works in three simple steps. First, it counts the length — how many characters your password has. Second, it works out the pool: how many possible characters each position could have come from. It scans for four classes and adds their sizes: 26 if there is a lowercase letter, another 26 for an uppercase letter, 10 for a digit and 32 for a symbol. Use all four classes, as the worked example does, and the pool is 94. Third, it multiplies: entropy = length × log₂(pool). With a pool of 94, every character adds about 6.555 bits, so the 12-character example reaches 12 × 6.555 = 78.66 bits. The total is then placed in a band: under 40 is Weak, 40–60 is Fair, 60–80 is Strong and 80+ is Very Strong. The lesson hides in step three: because the length is the multiplier, every extra character adds its chunk of bits all over again — which is why making a password longer beats decorating a short one with symbols.
Real-World Uses
Someone setting up a password manager uses this checker on the master password — the single password that guards all the others — trying candidate phrases until one lands in the Very Strong band before they commit to it. A woman opening a new email account is torn between a short, complicated password she might forget and a longer passphrase she can remember; she types both into the checker, sees how the two entropies compare, and picks with evidence rather than guesswork. And a man who has used variations of the same password for years checks the original here, sees an uncomfortable rating, and finally works through his important accounts replacing it with something long and unique for each site.
Benefits
- Entropy in bits, not vague bars
- Private — computed locally
- The class-pool logic explained
- Useful for passphrases too
Features of Our Tool
- Instant results in your browser
- No sign-up, no download, 100% free
- Works on mobile, tablet and desktop
- Clear step-by-step explanation below the tool
- Private — your entries never leave your device
Common Mistakes
- Trusting “complexity” rules over length — length beats !@#$
- Reusing passwords across sites
- Thinking a strength meter guarantees safety (phishing beats entropy)
Common Mistakes to Avoid
First, do not trust complexity rules over length: a short password dressed up with symbols still has few characters to multiply, and the formula above shows length doing the heavy lifting. Second, never reuse one strong password on several sites — if a single site leaks it, attackers will try it everywhere, and its entropy will not save you. Third, a high score is not a guarantee of safety: phishing tricks you into handing the password over, so no amount of entropy helps; stay suspicious of links asking you to sign in. Finally, be careful where you test passwords at all — only paste one into a checker, like this one, that computes everything in your browser and sends nothing anywhere.
FAQ
What is password entropy?
Bits of randomness: length × log₂(character pool) — 78.66 bits here.
Is 78 bits strong?
Strong by this tool’s bands (60–80); 80+ is Very Strong.
Length or complexity?
Length — a 20-character lowercase passphrase beats an 8-character complex one.
Is my password sent anywhere?
No — the check runs entirely in your browser.
What is a good password?
Long (16+ characters), unique per site, stored in a password manager.
What is a passphrase — and is it stronger than a password?
A passphrase is several ordinary words joined together. Because entropy grows with length, a long passphrase of plain words can outscore a short jumble of symbols: as the FAQ above notes, a 20-character lowercase passphrase beats an 8-character complex one.
How many bits of entropy should I aim for?
Use this tool’s bands as your guide: 60–80 bits is rated Strong and 80+ is Very Strong. For an important account, such as the email address you use to reset everything else, aim for the Very Strong band.
Related Calculators