Password Strength Checker

Entropy in bits equals log2(charsetSize) x length. Each character class adds to the charset: lowercase a-z adds 26, uppercase A-Z adds 26, digits 0-9 add 10, and symbols (any printable non-letter, non-digit character) add 32. A 12-character password using all four classes draws from 94 characters, giving about 78 bits. Spaces are detected and shown but never counted toward the charset.

The calculator rates anything below 28 bits as very-weak, 28-35 as weak, 36-59 as moderate, 60-127 as strong, and 128+ as very-strong. For real-world safety, 60 bits is a practical floor against offline attacks on modern hardware, 80+ is comfortable for most accounts, and 128+ is overkill for almost everything. These are estimates: actual risk depends on how the site stores and rate-limits passwords.

A passphrase of four to six random words from a large list (like the EFF's 7,776-word Diceware list) typically beats a short random password on both entropy and memorability. Four random words yields about 51 bits, six yields about 77 bits. The key word is random: a phrase you invent yourself is far less secure than one generated by a tool.

No. A strong password helps if a site's database is breached, but it cannot stop phishing, malware, or reuse of a password you already leaked elsewhere. Pair every important account with a second factor (a TOTP app, a hardware security key, or a passkey) so a stolen password alone is not enough to get in.

Nowhere. All analysis runs entirely in your browser via JavaScript. Your password is never sent to a server, saved to localStorage, or logged anywhere. Close the tab and it is gone.