There is no transmission possible here, and that is worth stating explicitly rather than leaving it implied. This is a static site with no server component behind the tool, so there is no upload endpoint for your password to reach even if one wanted to send it somewhere. Every character you type stays in your browser tab's memory and disappears the moment you close or refresh the page.
Entropy in bits is the standard way cryptographers reason about password strength, because it converts something abstract, how many guesses an attacker would realistically need, into one comparable number. Each additional bit of entropy doubles the number of guesses required, so a password with 60 bits of entropy is a million times harder to guess than one with 40 bits, not merely somewhat harder.
How this password strength checker calculates entropy
Entropy is calculated as the password's length multiplied by the base 2 logarithm of the size of the character pool it draws from. This password entropy calculator detects which classes are present, lowercase letters, uppercase letters, digits and common symbols, and sums their sizes to determine that pool: 26 for lowercase, 26 for uppercase, 10 for digits and roughly 32 for common keyboard symbols, giving a maximum pool of 94 characters when all four classes appear.
A 10 character password using only lowercase letters draws from a 26 character pool, giving roughly 47 bits of entropy. Adding uppercase, digits and symbols to the same 10 characters expands the pool to about 94 characters and raises the entropy to roughly 66 bits, without changing the length at all. That said, length still matters more than class variety for the same relative increase, which is why a longer password beats a shorter one stuffed with symbol variety in most direct comparisons.
- Longer passwords beat shorter ones with more symbol variety in almost every direct comparison.
- Below 40 bits of entropy is weak enough to fall to a determined offline attack quickly.
- 40 to 60 bits is fair, usable for lower value accounts but not future proof.
- 60 to 80 bits is strong for most personal and business accounts today.
- Above 80 bits is comfortably strong against any realistic offline cracking attempt with current hardware.
Why a common password check password strength math alone misses
Entropy math assumes an attacker has to try every combination in the character pool systematically, but real attackers do not work that way first. They start with lists of the millions of passwords leaked from previous data breaches and try those first, because a shocking number of accounts still use passwords like password123 or qwerty, which have plenty of raw entropy by the character pool calculation but are among the very first guesses any real attacker tries.
That is why this tool checks your entered password against a short list of extremely common passwords before it trusts the entropy number at all. A password that appears on that list is flagged as very weak immediately, regardless of what its raw entropy calculation would otherwise suggest, since a memorised or unmodified list entry offers essentially no real protection no matter how long or how symbol rich it happens to be.
How strong is my password: reading the qualitative rating
The rating shown alongside the entropy number translates the bit count into a plain language verdict using the same thresholds security guidance commonly cites: below 40 bits is weak, 40 to 60 is fair, 60 to 80 is strong, and above 80 is very strong. If you are asking yourself how strong is my password for a specific account, compare the resulting bit count against how sensitive that account actually is, since a weak password guarding a throwaway forum account carries far less risk than the same password guarding a primary email or banking login.
The rating is a floor, not a guarantee. A password can have a high entropy score by this calculation and still be genuinely weak if it follows a predictable pattern, such as a keyboard walk like qwertyuiop or a slightly modified dictionary word, since pure character pool math cannot detect a pattern, only measure raw character variety and length.
How this tool works under the hood and what it never does
Character classification runs through simple regular expression tests against your input, and the password is iterated using standard unicode aware string iteration so multi byte characters, such as an emoji, count as a single character rather than being split into confusing partial units. None of this requires the Web Crypto API, since entropy estimation is arithmetic on lengths and pool sizes, not a cryptographic operation.
What this password strength checker never does is send, log, cache or store the password you type anywhere. Checking it against the common password list and running the character class regular expressions both operate on a JavaScript string variable that exists only for the lifetime of the page, with no analytics event, no local storage key and no request object anywhere in that code path capable of carrying the value elsewhere.
| Entropy range | Rating | Practical meaning |
|---|---|---|
| Below 40 bits | Weak | Falls to a determined offline attack quickly |
| 40 to 60 bits | Fair | Usable for low value accounts, not future proof |
| 60 to 80 bits | Strong | Suitable for most personal and business accounts |
| Above 80 bits | Very strong | Comfortably strong against realistic offline attacks |
How to check password strength with this tool
- 1
Type your password
Enter the password you want to evaluate. Nothing is transmitted, so this is safe to do with a real password.
- 2
Run the check
Press check strength to calculate entropy in bits based on length and character class variety.
- 3
Read the entropy and rating
Compare the bit count and qualitative rating against how sensitive the account actually is.
- 4
Watch for the common password warning
A password on the common password list is flagged as very weak regardless of its raw entropy score.
Related tools worth bookmarking
Sources and further reading
- NIST SP 800-63B: Digital Identity GuidelinesThe authoritative federal guidance on password length, entropy and authenticator strength this checker's thresholds follow.pages.nist.gov
- OWASP Cheat Sheet SeriesPractical, widely followed guidance on authentication, including why common password lists matter more than raw entropy.owasp.org
- MDN: Iteration protocolsThe unicode aware string iteration this tool uses so multi byte characters count correctly as single characters.developer.mozilla.org
Frequently asked questions
Common questions about the password strength checker.
No. This is a static site with no server component for tool processing, so there is no endpoint that could receive your password even if the page attempted to send it. Every calculation runs locally in your browser tab and nothing is logged, cached or transmitted at any point.
Entropy equals the password's length multiplied by the base 2 logarithm of the character pool size, where the pool size is the sum of the sizes of whichever character classes, lowercase, uppercase, digits and symbols, actually appear in the password. A longer password or a larger pool both raise the entropy, with length having the larger effect for an equivalent relative increase.
Most likely because it matched an entry on this tool's common password list, which overrides the raw entropy calculation. Character pool math cannot detect that a password is a well known leaked password or a predictable pattern like a keyboard walk, so the common password check exists specifically to catch exactly that case.
Above 80 bits is comfortably strong against any realistic offline cracking attempt with current hardware, while 60 to 80 bits is strong enough for most personal and business accounts today. Below 40 bits should be treated as genuinely weak regardless of how the password looks at a glance.
Not necessarily. What actually matters is whether adding a character expands the character pool the password draws from and how much length increases alongside it. In most direct comparisons, adding several more characters to the length helps more than adding one additional symbol to a short password.
Treat it as one useful signal, not the only one. Uniqueness per account and using a password manager to generate and store long random passwords both matter as much as the raw strength number, since even a high entropy password offers little protection if it is reused across multiple accounts that later get breached.