About the Password Strength Checker
Tezmy's Password Strength Checker rates a password from Very weak to Very strong while you type. It estimates its strength in bits, shows roughly how long a fast offline attack would need to guess it, and gives a checklist of what helps and what hurts: length, a mix of character types, common passwords, keyboard runs like “qwerty”, repeated characters and years. The check runs entirely in your browser. Your password is never sent over the internet, saved or logged, and the box has spell-check and autofill turned off.
Updated October 2026
How to use the Password Strength Checker
- 1Type a password into the box. Press Show if you want to see what you typed.
- 2Read the strength rating and the estimated time to crack it.
- 3Go through the checklist to see what makes it weaker.
- 4Change the password until it is Strong or Very strong.
What the checker looks at
- Length: at least 12 characters is the first item on the checklist.
- Character types: lower case, upper case, numbers and symbols each add to the number of possible guesses.
- Common passwords: a built-in list of the most used passwords, like 123456, qwerty and password1, which are always rated Very weak. Disguised versions count too, such as P@ssw0rd2024 or !Dr@g0n99.
- Keyboard runs and sequences: four or more characters in a row from abcd…, 1234… or the rows of the keyboard, forwards or backwards.
- Repeated characters: the same character three or more times in a row, like aaa or 111.
- Years: anything that looks like a year from 1900 to 2099, which attackers try early.
How the rating works
The tool first estimates entropy: the password length multiplied by how many different characters could appear in each position. It then lowers the estimate for each weak pattern it finds. The result, in bits, gives the rating: under 28 bits is Very weak, 28–39 Weak, 40–59 Fair, 60–79 Strong and 80 or more Very strong. A password on the common list is always Very weak.
This is an estimate. It can't know that a password is your pet's name or your street, and it doesn't check leaked-password databases, so a password it rates Strong can still be weak if it's personal or reused.
Tips for passwords that are strong and easy to remember
- Use a passphrase: five or six unrelated words, like “maple-orbit-violin-cactus-harbor”, are long, strong and easy to type.
- Don't build passwords from names, birthdays, phone numbers or favourite teams.
- Don't rely on swaps like @ for a or 0 for o; attackers try them automatically.
- Use a different password for every site, so one leak can't unlock the others.
- Let a password manager create and remember long random passwords for you.
- Turn on two-step verification wherever it is offered.
On your phone or computer
The checker works the same in every browser. On a phone, press Show to see what you typed, since small keyboards make typos easy. The box won't suggest saved passwords and won't correct spelling, so what you type stays only in that box until you leave the page. If the result is weak, create a stronger one with the UUID Generator for a long random value, and keep only its fingerprint using the Hash Generator.
Features
- Strength rating from Very weak to Very strong
- Estimated entropy in bits
- Rough time to crack in a fast offline attack
- Spots common passwords, keyboard runs, repeats and years
- Checklist of what to improve
- Runs on your device: never sent, saved or logged
Frequently asked questions
Is it safe to type my real password here?
The check runs only in your browser: the password is not sent over the internet, saved on the page or written to any log, and spell-check and autofill are off for the box. Still, a good habit is to test a password that is similar to yours rather than the exact one you use.
What makes a password strong?
Length matters most. A long password with a mix of lower case, upper case, numbers and symbols, and without real words in a predictable pattern, takes far longer to guess. Five or more random words together, or 14 or more random characters, are strong choices.
How long should my password be?
Use at least 12 characters, and 14–16 or more for important accounts like email and banking. Each extra character multiplies the number of guesses an attacker needs.
How is “time to crack” worked out?
The tool estimates how many guesses are needed from the length and the kinds of characters used, then lowers that number for common passwords, keyboard runs, repeats and years. Passphrases made of words are counted word by word, because attackers guess whole words, not single letters. It assumes a fast offline attack of 10 billion guesses per second, which is possible against leaked password files. It is a rough guide, not a guarantee.
Why is “P@ssw0rd2024” rated very weak?
Attackers try common words with predictable swaps (a to @, o to 0) and years first. A password built from a well-known password plus a year is much easier to guess than its length suggests, even though it has all four kinds of characters. The checker spots these: it removes numbers and symbols at the start and end, undoes the usual swaps, and compares what is left with its list of common passwords.
What is password entropy?
Entropy, measured in bits, describes how unpredictable a password is. Each extra bit doubles the number of guesses needed. As a rough guide, under 28 bits is very weak, 60 bits and above is strong, and 80 bits and above is very strong.
What should I do if my password is weak?
Make it longer first, then avoid names, dates and keyboard patterns. The easiest way to get a strong one is the Password Generator, and a password manager can remember it for you. Use a different password for every account.
Can a strong password still be hacked?
Yes, if it is stolen rather than guessed, for example through a fake login page or a data leak from a site that reused it. Turn on two-step verification (2FA) for important accounts and never reuse passwords.