Password Strength Checker
Review password length and obvious repeated or sequential patterns locally with transparent, NIST-aligned feedback.
Privacy: your files never leave your device. All processing happens locally in your browser.
How to use
- 1.Enter or paste the proposed password; it remains local and hidden unless you press Show.
- 2.Review length, the descriptive character-group count, the pattern flag and each recommendation.
- 3.Use a unique password manager entry, the account provider's breach/blocklist check and MFA; do not treat the score as a guarantee.
About Password Strength Checker
Password Strength Checker provides a local, transparent review of a password or passphrase. It counts Unicode code points, reports how many broad character groups appear, flags simple repeated chunks and four-character ascending or descending sequences, and assigns a five-level label. Nothing is uploaded, stored or checked against a remote service.
The score prioritizes length because current NIST guidance treats passwords shorter than 15 characters as weak when the password is the only authentication factor. Empty input scores zero, fewer than eight characters scores Weak, eight through fourteen scores Fair, and a simple repeated or sequential pattern is capped at Fair. A non-patterned value of 15 through 19 characters scores Good; 20 or more scores Strong.
These thresholds are feedback rules, not a claim that every long string is safe. Attackers use breach corpuses, dictionaries, service-specific words, keyboard paths, personal facts and probabilistic models rather than trying every character combination. NIST notes that estimating entropy for user-chosen passwords is difficult. This page deliberately avoids advertising a cracking-time or bits-of-entropy guarantee.
Character-group count is descriptive only. It notes lowercase, uppercase, digits, symbols, whitespace and non-ASCII characters, but it does not require one of each. Forced composition rules often lead to predictable substitutions and do not replace length or blocklist screening. Spaces and Unicode can support memorable passphrases, although the target service must accept and normalize them consistently.
Pattern detection is intentionally narrow and explainable. It finds a short chunk of up to four code points repeated at least three times, or a run of four code points increasing or decreasing by one. It cannot recognize every keyboard walk, quote, song lyric, name, date, language dictionary word or leaked password. A No pattern result only means those two checks did not fire.
A production verifier should compare the complete proposed password with a current blocklist of common, expected and compromised values. This page does not download such a database and does not send a partial hash to a breach service, so it cannot tell whether the password has appeared in a leak. Follow the account provider's breach warning even if this local meter says Strong.
Use a password manager to generate and store a different random password for each account. Enable multi-factor authentication, especially for email, finance, cloud and administrator access. Change a password when it is reused, exposed or suspected compromised rather than on an arbitrary calendar. Service operators must store passwords with a suitable salted password-hashing function, not fast SHA or reversible encryption.
Eight fixtures lock the published score boundaries: empty, short, sequential, repeated, fourteen-character, an eleven-character mixed value, a nineteen-character phrase and a twenty-eight-character passphrase. Unicode length is tested by code point so an emoji is not automatically counted as two UTF-16 units. Input remains visible only when the user explicitly presses Show.
Treat the result as guidance for choosing a better secret, not certification. Prefer a unique manager-generated password or a long unique passphrase, verify that the real service accepts its characters, check the complete value against the service's blocklist, and combine it with MFA or a phishing-resistant passkey when available.
Methodology & sources
The meter counts Unicode code points, applies published length bands, and caps the score when it finds a repeated 1-4 code-point chunk or a four-character monotonic sequence. It does not estimate entropy or query breach lists.
Frequently asked questions
Related tools
- Password GeneratorGenerate strong random passwords locally with a cryptographically secure RNG — nothing is ever uploaded.
- JWT GeneratorCreate a compact HS256 JWT from strict JSON claims with standards-based base64url encoding and browser-native HMAC-SHA-256.
- AES Encryption OnlineEncrypt text into a portable authenticated AES-256-GCM JSON package or decrypt a package with its password entirely in your browser.
- ASCII ConverterConvert standard 7-bit ASCII text to decimal codes or decode decimal codes back to exact ASCII characters locally.
- Base100 Encoder / DecoderEncode UTF-8 text as the original Base100 emoji mapping or strictly decode Base100 symbols back to valid UTF-8 text.
- Base32 Encode / DecodeEncode UTF-8 text to canonical RFC 4648 Base32 or decode padded and unpadded Base32 back to strict UTF-8.