Type a password and this checker estimates its strength from its length and the kinds of characters it uses, then lowers the score for patterns attackers try first: common and leaked passwords, repeated characters, sequences like abc or 123 and keyboard walks like qwerty. You see the estimated entropy in bits, a rating from very weak to very strong and how long it might take to crack.
The check runs entirely in this page: your password is never sent, saved or logged. Even so, it is good practice to test a password that is similar to yours rather than the real one. For a new, truly random password, use our password generator.
How to use the Password Strength Checker tool
- Type a password in the box. Tap Show to see what you typed.
- Read the rating, entropy and crack time estimates.
- Go through the checklist and fix anything marked with a cross.
- Aim for at least Strong, ideally with 12 or more characters.
Why use ToolOrca Password Strength Checker
- Entropy estimate in bits
- Offline and online crack time
- Common and leaked password check
- Detects sequences, repeats and keyboard patterns
- Clear checklist of improvements
- Never leaves your browser
What makes a password strong?
Length matters most. Each extra character multiplies the number of possible passwords. A random 8-character password using all character types has about 52 bits of entropy; a random 16-character one has about 105 bits, which is far beyond any practical attack.
Randomness matters too. Attackers do not guess letter by letter; they try leaked password lists, dictionary words, names, dates and common substitutions such as P@ssw0rd first. A long passphrase of four or five random words, or a password from a generator stored in a password manager, beats a short "complex" password.
How the crack time is estimated
The offline figure assumes an attacker has stolen a password hash and can test 10 billion guesses per second with graphics cards, which is realistic for fast hashes like MD5 or SHA-1. The online figure assumes 100 guesses per second against a login page. Sites that use slow hashes (bcrypt, Argon2) and rate limits make real attacks much slower. These numbers are estimates for comparison, not guarantees.
Frequently asked questions
Is it safe to type my password here?
The page does not send or store anything; you can check this by disconnecting from the internet and using it offline. If you prefer, test a similar password rather than your real one.
How long should my password be?
At least 12 characters for everyday accounts, and 16 or more for email, banking and password-manager master passwords.
Are passphrases better than complex passwords?
A passphrase of four or more random, unrelated words is both strong and easy to remember. Famous quotes or song lines are not random and are easy to guess.
Why is my long password rated weak?
It probably contains a common password, a keyboard pattern or a sequence. For example Password123456 is long but appears in leaked lists.
How do I create a strong password?
Use the password generator to create a random one and save it in a password manager.