Password Strength Validator🔒 100% local
Test password strength. Privacy-first, no server uploads, no tracking.
Related Tools
Scores one password and prints a fixed-width report: the password masked with asterisks, a ten-block strength bar, a verdict, an entropy estimate in bits, an offline crack-time estimate and an eight-line checklist. The candidate is scored as the plain string the text area holds, so checking a password here does not put it on the wire - the page issues no request while you work.
How to use it
- Type or paste the candidate into the Input box. The text area renders it in clear, so avoid it on a shared or recorded screen.
- Press Process.
- Read the Strength bar, the Verdict, the entropy and crack-time lines, then the checklist. Clear empties both boxes.
Worked example
MyP@ssw0rd!becomesPassword: ***********
Strength: █████████░
Verdict: STRONG
Entropy: 72.3 bits (pool of 95 symbols × 11 chars)
Crack time (offline, 10 billion guesses/s): 9012 years
Checklist:
✓ at least 8 characters (11)
✗ 12+ characters (better)
✓ lowercase letters
✓ uppercase letters
✓ digits
✓ symbols
✓ no runs of 3+ repeated chars
✓ no keyboard sequences (abc/123…)
Tip: length beats complexity — 4+ random words beat short "complex" passwords.The symbol class adds 33 characters to the pool, so eleven characters reach 72.3 bits even though the middle spells a dictionary word with an @ for the a.
password123becomesPassword: ***********
Strength: ██░░░░░░░░
Verdict: VERY WEAK — common/leaked password (found in common-password lists)
Entropy: 56.9 bits (pool of 36 symbols × 11 chars)
Crack time (offline, 10 billion guesses/s): 76 days
Checklist:
✓ at least 8 characters (11)
✗ 12+ characters (better)
✓ lowercase letters
✗ uppercase letters
✓ digits
✗ symbols
✓ no runs of 3+ repeated chars
✗ no keyboard sequences (abc/123…)
Tip: length beats complexity — 4+ random words beat short "complex" passwords.A 6+ character word from the built-in list subtracts 3 points and forces the VERY WEAK verdict, so the entropy figure (56.9 bits) and the verdict deliberately disagree.
When to use it
- Checking a candidate against a policy that demands upper case, lower case, a digit and a symbol before you commit it to a password manager.
- Comparing a long passphrase with a short mixed-case string to see which survives an offline attack longer.
- Showing a colleague why 'P@ssw0rd' style substitutions buy less than they expect - the checklist marks the same classes either way.
What it does not do
- The crack time assumes 10 billion guesses per second against the raw character pool and models no dictionary or mask attack. That is why 'password123' prints 56.9 bits and 76 days while a real cracking rig opens it immediately.
- Anything under a minute is rounded to whole minutes and printed as '0 min', so that line means seconds, not zero.
- The common-password list is 31 entries and the match is a substring test, so passing it only means your password does not contain one of those words - 'summer2019Sydney' sails through.
- Entropy comes from which character classes appear, not from how the password was chosen: two strings of the same length and class mix get identical bit counts, and only the repeated-character check tells them apart.
- Nothing is stored and nothing is sent, but the input is a plain text area - anyone reading over your shoulder sees the password as you type it.