Password Strength Checker
Check how strong a password is, with an entropy and crack-time estimate. Runs entirely in your browser. Your password is never sent anywhere.
*Rough brute-force estimate at 10 billion guesses/second offline. Real-world risk depends heavily on whether the password is reused, leaked, or based on a guessable pattern.
What does this check?
PassCheck estimates a password's strength from its length and character variety (lowercase, uppercase, digits, symbols), showing the resulting entropy in bits and a rough order-of-magnitude brute-force crack-time estimate.
Think swapping letters for symbols makes a password safe? Read Why "P@ssw0rd1!" Is Weaker Than It Looks.
How it works
Everything runs directly in your browser's memory. Nothing is sent to a server, logged, or stored, so it works even offline once the page has loaded.
Frequently asked questions
Is this free to use?
Yes. There's no sign-up and no limit on how many passwords you check.
Do you store or send my password anywhere?
No, never. The check runs entirely in your browser's memory. The password is not sent over the network, logged, or written to disk, even temporarily. See the privacy policy for details.
How is strength calculated?
From entropy: the character set size (lowercase, uppercase, digits, symbols each add to the pool) raised to the power of the password's length, expressed in bits. It's a length-and-variety estimate, not a check against real breach databases or known-password lists.
Is the crack-time estimate accurate?
It's a rough order-of-magnitude estimate assuming a brute-force attack at a fixed guess rate, not an exact figure. Real attacks often exploit patterns, reused passwords, or leaked databases well before brute force becomes relevant, and hardware speeds keep changing.