01
A common leaked password
Typing "password1" rates as Very weak — it's on the common-password list, so it's treated as crackable instantly regardless of length.
Password Strength Checker
Data ToolsCheck password strength online with estimated crack time and security tips — free and private.
Everything happens in your browser — the password you type here is never sent anywhere, including to us.
About
About the Password Strength Checker
Rates a password's strength as you type, estimates how long it would take to crack, and flags common, easily-guessed passwords as weak.
Anyone setting a new password uses it to see whether it's actually strong before committing to it, and IT and security teams use it to demonstrate to users what makes a password weak versus strong. It's one of many free data tools on Toolapt, and like every tool here, it's free to use with no sign-up and no limit on how many times you run it.
Examples
Password Strength Checker examples
3 worked examples
02
Short but mixed
Typing "Sunset87" (8 characters) rates as Reasonable, at roughly 47.6 bits of entropy — an estimated crack time around 3 hours.
03
Long and varied
Typing "Tr0ub4dor&3" (11 characters) rates as Strong, at roughly 72.3 bits of entropy — an estimated crack time around 9,000 years.
Related tools
FAQ
Frequently asked questions
Quick answers to common questions about the Password Strength Checker.
What does the Password Strength Checker do?
It rates a password's strength as you type it and estimates roughly how long it would take to crack, along with a checklist of criteria it meets.
Is the Password Strength Checker free to use?
Yes. It's free, with no sign-up, no watermark and no limit on how many times you use it.
Is my password safe when I use this tool?
Yes. Everything happens in your own browser — the password you type is never sent anywhere, including to us, and it isn't stored anywhere either.
How is the crack time estimated?
It's based on the password's entropy — a measure derived from its length and which character types it uses — assuming a fixed, illustrative guessing rate. It's a rough estimate for comparison, not a precise prediction against any specific attacker or system.
Why did a long password still get scored as weak?
If it matches a list of extremely common, easily-guessed passwords (like "password1" or "qwerty"), its effective strength is scored as zero regardless of length, since real attackers try common passwords first.
What does the checklist actually check?
Length thresholds (8 and 12 characters), and whether the password contains lowercase letters, uppercase letters, numbers, and symbols, plus whether it's one of the common passwords in the built-in list.
Should I actually use this on my real, current password?
It's safe to — nothing is sent anywhere — but if you're at all unsure, testing a similar but not identical password still gives you a useful sense of its strength.
Can I use this tool on my phone?
Yes. The page is fully responsive and works on mobile, tablet and desktop browsers alike.