Password Strength Checker
Check password strength
Check password strength Runs locally in your browser
Scoring happens in your browser only. The password is never sent anywhere or stored.
About the
The Password Strength Checker scores a password out of seven using plain, explainable rules: length thresholds, and the presence of lowercase, uppercase, digits and symbols. It reports which of those you satisfied, so you can see exactly what moved the score rather than getting a bare verdict. The point of showing the criteria is that length dominates everything else: a long passphrase without symbols beats a short password that ticks every character class. The check runs entirely in your browser and nothing is transmitted.
Where people use the
- Checking whether a password meets a minimum policy before submitting it.
- Showing someone why a short complex password is weaker than a long simple one.
- Testing a generated passphrase before adopting it.
- Auditing which character classes a legacy password is missing.
How to use the
- 1
Type a password
Use the single-line field. The score updates when you run it.
- 2
Read the score and the breakdown
You get a figure out of seven plus a list showing whether lowercase, uppercase, digits and symbols are present, and how long the password is.
- 3
Add length before anything else
Going from 8 to 16 characters is worth more to the score than adding a symbol. A four-word passphrase is both stronger and easier to remember.
- 4
Do not paste a password you actually use
Type a representative example of the same shape instead. The habit of pasting real credentials into websites is worth not practising.
Tips and best practices
- Length first, symbols second; a four-word passphrase beats P@ssw0rd.
- Never reuse a password across sites, however strong it is.
- Turn on two-factor authentication; it matters more than password complexity.
Frequently asked questions
How is the score calculated?
One point each for at least 8 characters, at least 12, lowercase, uppercase, a digit, a symbol, and at least 16 characters. Seven points is Excellent. It is deliberately simple and transparent, not a statistical estimate.
Is a high score the same as a strong password?
No. This checks character composition, not unpredictability. Password1! scores well here and is among the first things an attacker tries. Real strength means length plus randomness, and ideally uniqueness per site.
What matters more, length or symbols?
Length, by a wide margin. Each extra character multiplies the search space, while a symbol adds a fixed amount. Twenty characters of lowercase letters beats ten characters of mixed classes, and is easier to type.
Do you store or send the password?
No. Everything happens in your browser tab and nothing is logged or transmitted. Even so, the sensible habit is to test a representative example rather than the real thing.
Why is my long passphrase marked only Fair?
Because it is missing character classes. If it is long and made of genuinely uncommon words, it is stronger than the score suggests; the scoring is a rough guide, not an entropy calculation.
Should I also use a password manager?
Yes. A manager lets every password be long, random and unique, which does more for your security than any composition rule. This tool is a teaching aid, not a substitute.