Password strength checker

About this tool

Most password strength meters score the wrong thing. They count character classes — did you use an upper case letter, a digit, a symbol — and reward you for each one. That is why P@ssw0rd1! shows four green bars on a great many sign-up forms, despite being one of the first few thousand guesses any real cracking rig makes.

NIST's current guidance says the opposite. SP 800-63B, under Password Verifiers, states that verifiers “SHALL NOT impose other composition rules (e.g., requiring mixtures of different character types) for passwords”. What it requires instead is a minimum of 15 characters for a password used on its own, acceptance of at least 64, and a check against a blocklist of common, expected or compromised values — compared against the whole password, not substrings.

So this page runs the NIST-aligned check as the live result, and shows the conventional meter and the raw character-set entropy calculation next to it, so you can see them disagree.

How it works

Model A, the live verdict. The password is broken into segments. Each segment is matched against an embedded list of common passwords, the 1,296-word EFF wordlist, keyboard runs, character sequences, repeated blocks and date-like numbers — after normalising common letter-to-symbol substitutions, so P@ssw0rd is recognised as password. Every segment gets a guess count, the counts are multiplied, and the result is multiplied again by the number of orderings the segments could have appeared in. Uncovered stretches fall back to brute force over the character classes present. An exact blocklist hit overrides everything and returns the lowest possible verdict, which is how NIST treats it.

Model B, the conventional meter. One point each for reaching 8, 12 and 16 characters, and one each for containing a lower case letter, an upper case letter, a digit and a symbol. Seven points available. This is the meter you have seen a thousand times.

Model C, character-set entropy. Count which classes appear, add up the alphabet size that implies, and compute length × log₂(alphabet). This is the calculation behind most “bits of entropy” claims. It is exactly right for a randomly generated string and badly wrong for anything a human chose, because it assumes every character was picked independently at random.

Common questions

Should I type my real password into a website?

As a rule, no — and you should be suspicious of any page that asks. This one does its work entirely in your browser, makes no network requests after the page loads, and stores nothing, which you can verify by reading the source or watching your network tab. But that is a claim, and the safe habit is to check a password of the same shape rather than the real one. If you want certainty, disconnect from the network before typing; the page will carry on working.

Why does it say my password is weak when other sites say it is strong?

Almost certainly because the other site is scoring character classes. Try the same password in the comparison table above — where Model B says “strong” and Model A says “very weak”, the password is usually a dictionary word with predictable decoration, which is precisely what cracking rules are built to try first.

Is 15 characters really the minimum now?

For a password used as single-factor authentication, yes — that is a SHALL in the current revision of SP 800-63B. Where the password is only one factor of several, the minimum drops to eight. Plenty of services have not caught up; that does not change what the guidance says.

Does this check whether my password has been in a breach?

No, and it cannot. A real breach check means asking a service like Have I Been Pwned, which is a network request — banned outright on this site because every free tool here promises that nothing you enter leaves your browser. The embedded list of common passwords is a poor substitute for a breach corpus, and it is labelled as one. See Known limitations.

What should I do instead of picking a password?

Let something else pick it. A password manager's generator, or the passphrase generator on this site, produces a secret whose strength can be calculated exactly rather than estimated.

Known limitations

• No breach checkingThe Have I Been Pwned range API would be the single most useful check here, and it is deliberately not used because it requires a network request. This is disclosed rather than quietly omitted.
• The blocklist is curated, not a corpusRoughly 590 entries, compiled from widely published summaries of common passwords. It is not a verified copy of a named breach corpus such as rockyou or the Pwned Passwords set, and it is not ordered by measured prevalence beyond the first few dozen. A real checker would match against hundreds of millions of entries. Treat a clean result as "not obviously terrible", not as "not breached".
• Not zxcvbnzxcvbn is the reference implementation of this kind of pattern-aware scoring and it is a third-party library, which this site does not load on any tool page. The segmentation here is a simplified hand-written version of the same idea: fewer dictionaries, no user-supplied context, no L33t table as complete as theirs. Expect it to be more pessimistic on unusual passwords and less clever on layered ones.
• Guess rates are assumptionsThe four attack rates in the table are stated round figures for illustration, not measurements of any particular hardware. Real rates depend entirely on the hash used, how it was configured, and what the attacker is willing to spend. Treat the times as orders of magnitude.
• English wordlist onlyThe dictionary check uses the 1,296-word EFF short list. A password built from words in another language, or from proper nouns, will not be recognised as a dictionary password and will score better than it deserves.

The same job at the command line

• grep -Fx "$PASSWORD" rockyou.txtAn exact match against a real breach corpus, offline. This is the check that actually matters, and it needs the corpus on your own disk.
• hashcat -m 0 -a 0 hashes.txt rockyou.txt -r best64.ruleRuns the corpus through mangling rules — the leet substitutions, appended digits and capitalisations this page detects. If your password survives this, the decoration was not the weak part.
• pwscoreFrom libpwquality on most Linux distributions. Scores a password from standard input against the system policy, offline.

Sources

NIST Special Publication 800-63B, Digital Identity Guidelines — pages.nist.gov/800-63-4/sp800-63b.html, checked 17/08/2026. The dictionary is EFF's short wordlist, licensed CC BY 3.0 US — eff.org.