Password strength checker that shows which parts of your password are weak

No, and nothing on this page will ever claim otherwise. Checking a password against breach data means sending something derived from it to a service that holds the corpus — and this page makes no network requests at all, which is the entire reason to use a local tool for this. So please read the verdict correctly: a password that scores Very strong here and appears in a breach corpus is worthless, because attackers try known passwords before they try anything else. Strength and exposure are two different questions, and this page can only answer one of them.

In two steps you can redo by hand. First, the character classes present are added up into a pool and one character is valued at log2(pool). Second, the password is scanned for patterns, and each pattern found replaces its stretch of characters with what that stretch costs an attacker who knows the pattern. “Summer2024!” is a worked example: the pool is 94, so each character looks like 6.55 bits and the raw figure is 72.1. But “Summer” is in the common list (8.8 bits, not 6 × 6.55), and “2024” is one of 200 years (7.6 bits, not 4 × 6.55). Only the “!” is left as a free character. The estimate lands near 23 bits — a quarter of what the length suggested.

Runs of the same character three or more long; alphabetical or numerical sequences three or more long, in either direction; straight runs of four or more along a QWERTY row, including the shifted number row; four-digit years from 1900 to 2099; eight-digit dates; a six-digit input that reads as a day, month and year; the 220 common passwords carried in the page; and the 2,048 four-to-six-letter everyday words carried in the page. Simple character substitutions are undone before the last two checks, so “P@ssw0rd” is recognised as “password” with two bits added back for the substitutions.

A great deal, and knowing what is more useful than the score. Its word list is 2,048 words of four to six letters — a real cracking dictionary runs to millions and includes every name, place, band, film and football club, in every language. So “battery” is seven letters and is counted here as if it were random, which it is not. The famous four-word example built from “correct horse battery staple” is rated as very strong by this page and would fall in seconds to a list that contains the phrase. Obscene passwords, which sit near the top of every real list, were deliberately left out of this one — their absence here does not make them safe. Treat a low score as proof of weakness and a high score as the absence of proof, not as a guarantee.

Because entropy is a property of the process that made a password, not of the string itself, and this is the clearest way to see it. Generate a four-word passphrase on the password generator and it will report 44 bits: four words drawn from a list of 2,048, and 4 × log2(2048) = 4 × 11 = 44. Paste the same passphrase in here and this page will report more, because it can only see what it can prove — it recognises the words, but it has to treat the separators and the ordering as free characters. The generator knows how the string was made. This page is reconstructing an upper bound from the outside, which is exactly what an attacker does, and it is why a checker can never be as certain as a generator.

From this page, yes: there is no request, no localStorage, no cookie and no URL parameter, and you can confirm it by opening your browser’s network panel or by switching the network off entirely — the page carries on working, which a page that phoned home could not do. The remaining risks are the ordinary ones and they are yours: someone reading your screen, a clipboard manager keeping a history, or a browser extension with permission to read page content. If any of those worry you, check a password with the same shape instead — the same length, the same pattern, different characters — because the shape is what this page is judging.

Barely, and it is the single most predictable thing anyone does. Appending one symbol to a word adds at most log2(32) = 5 bits if an attacker had no idea it was coming — and every cracking rule set has known about it for two decades, so in practice it adds close to nothing. The same goes for capitalising the first letter and for swapping “a” to “@”. This page charges one bit for each of those transformations rather than pretending they are free, and one bit is a factor of two against the millions of times over that four more random characters buy you.

Because there is no standard. Most meters score composition rules — has an uppercase, has a digit, is over eight characters — which is why “P@ssw0rd1” often passes them and is one of the first thousand things anyone tries. Meters that estimate entropy have to choose a pattern library and a set of bands, and no two choose the same. This page states its bands and shows every deduction so you can disagree with it specifically. If two meters disagree, take the lower one seriously and the higher one as unproven.

Change it where it matters most first: email, then anything that can reset a password by email, then banking. Length is the cheapest fix — the difference between 12 and 16 random characters from a full alphabet is a factor of about 78 million, and no amount of punctuation in a short password comes close. And the fix that outranks strength entirely is not reusing it: a strong password used on three sites is only as strong as the worst-run of the three, because the breach happens there and the password is then simply looked up.