Password Strength Checker

• Step 1: Type or paste a password into the input field. The results update in real time as you type, showing you how each character addition affects the rating. Use the eye button to show or hide the characters you typed.

• Step 2: Read the strength rating. The checker assigns one of five levels: Weak, Fair, Good, Strong, or Very Strong. It also shows a score out of 7, a color-coded progress bar, and an estimated crack time.

• Step 3: Review the suggestions. The Suggestions list tells you what to change to improve the password, such as adding length, mixing character types, or avoiding common patterns.

• Step 4: Check the Password Requirements list. Six quick checks turn green as the password meets them: at least 8 characters, lowercase letters, uppercase letters, numbers, special characters, and 12 or more characters (recommended). Treat this as a simple checklist. As the sections below explain, length matters more than ticking every box.

• Step 5: Iterate. Modify the password based on the suggestions and watch the rating respond. This interactive process helps you understand exactly what factors push a password from weak to strong.

• Step 6: Use the insights. Even if you do not use the specific password you tested, the feedback teaches you what properties make a password strong, which you can apply to every password you create.

A note on safety: As a general practice, avoid typing passwords you currently use into any online tool. Thetoolity's checker is built to process your password in your browser, but for your most sensitive passwords the safest option is to test a similar password of the same style, or to use the strength meter inside a reputable password manager. The copy button places the password on your clipboard, so clear your clipboard afterwards if you use it, especially on a shared computer.

Password strength is determined by how difficult the password is to guess or crack using automated methods. Two main attack approaches drive the definition of a strong password: dictionary attacks and brute-force attacks.

• Dictionary attacks try passwords from lists of known words, common passwords, and their variants. A password like "summer2024" fails immediately against a dictionary attack because both "summer" and "2024" are in every serious attacker's wordlist.

• Brute-force attacks try every possible combination of characters. The time this takes depends entirely on the password's length and the size of the character set it uses.

The formula for the total number of possible passwords is: character set size raised to the power of password length. This grows exponentially with each additional character, and the related measure is called password entropy.

How the numbers grow

• Lowercase letters only (26 characters): 8 characters = 26^8, about 208 billion combinations. 12 characters = 26^12, about 95 quadrillion combinations.

• Adding uppercase letters (52 characters): 8 characters = 52^8, about 53 trillion combinations.

• Adding numbers (62 characters): 8 characters = 62^8, about 218 trillion combinations.

• Adding special characters (95 printable ASCII characters): 8 characters = 95^8, about 6.6 quadrillion combinations. 12 characters = 95^12, about 540 sextillion combinations.

Modern password-cracking hardware can test billions to hundreds of billions of passwords per second against stored hashes that use fast algorithms. An 8-character password using only lowercase letters can be cracked in seconds to minutes by dedicated hardware in that situation. A random 16-character password using all character types would take far longer than the age of the universe.

The factors that decide strength

• Length: the most powerful single factor. Each additional character multiplies the possible combinations by the character set size.

• Character variety: using lowercase, uppercase, digits, and special characters increases the character set size, multiplying the combinations.

• Absence of dictionary words: a password made of real words is far weaker than its length suggests because attackers test word combinations first.

• Absence of common patterns: "Password1!", "Qwerty123", "123456abc" and similar patterns appear in every serious attacker's enhanced dictionary.

• Absence of personal information: names, birth years, and other personal details are tested early in targeted attacks. A checker cannot know your personal details, so you need to avoid them yourself.

The checker reports five levels. The exact score comes from the tool's own scoring rules, so read the descriptions below as general guidance on what each label usually means rather than exact cutoffs.

• Weak: crackable in a very short time by automated tools. Typical traits: fewer than 8 characters, only one character type, common words or sequences (password, 123456, qwerty), or obvious substitutions (p@ssword, passw0rd). Substitutions like @ for a and 0 for o add almost no real security, because dictionary crackers test these variants.

• Fair: minimal real-world protection. They may be 8 or more characters but use only two character types, contain a common word with numbers appended, or follow predictable patterns (capitalizing the first letter, adding numbers at the end). "Summer2024" and "Monkey123!" are examples. They pass basic complexity requirements but fail against any competent attack that includes enhanced dictionaries.

• Good: would take meaningful time to crack but are not at the recommended level for sensitive accounts. Typically 10 or more characters with several character types but still containing recognizable words or predictable structures.

• Strong: meets the criteria that serious security guidance recommends: 12 or more characters, a good mix of character types, no dictionary words, and no predictable patterns.

• Very Strong: long passwords, typically 16 or more characters, with good variety and no discernible patterns. For most practical purposes, these are computationally infeasible to crack by brute force within any reasonable timeframe.

About the estimated crack time

The crack time shown is a rough estimate. Real cracking time depends on how the website stores the password (a slow algorithm like bcrypt versus a fast one like MD5), how powerful the attacker's hardware is, and whether the password appears in a wordlist. Use the number to compare passwords with each other, not as a guarantee.

A longstanding debate in password security is whether it is better to have a long but simple password (a passphrase) or a shorter but highly complex one (random characters with all types). Modern guidance from NIST (the National Institute of Standards and Technology) and security researchers has shifted strongly toward length.

The passphrase approach

A phrase like "correct-horse-battery-staple" (popularized by the web comic xkcd and its author Randall Munroe) is 28 characters of lowercase letters and hyphens. Despite using only lowercase and hyphens (a small character set), its length makes it extremely strong when the words are chosen randomly. Because that example is now famous, never use it itself, but do use the idea: several random words, joined together.

By contrast, "Tr0ub4dor&3" is only 11 characters but appears complex. It is memorable for humans but contains patterns (word + number + special character) that appear in enhanced dictionaries.

NIST SP 800-63B guidance

NIST's Digital Identity Guidelines (SP 800-63B), first issued in 2017 and updated since, challenged conventional wisdom. The current revision (Revision 4, finalized in 2025) says:

• Prioritize length over complexity. The minimum length is 15 characters when a password is the only authenticator, and 8 characters when it is used as one part of multi-factor authentication.

• Allow long passwords, at least 64 characters, so passphrases work.

• Do not impose composition rules such as mandatory character types.

• Do not require periodic password changes unless there is evidence of compromise. Forced regular changes lead to predictable patterns (incrementing numbers, minor variations) that reduce security.

• Check passwords against known compromised password lists rather than only enforcing complexity rules.

• Allow printable ASCII characters, spaces, and Unicode characters in passwords.

• Do not use password hints or knowledge-based authentication questions.

These guidelines influenced many organizations to update their password policies away from arbitrary complexity requirements toward length and breach-list checking. They are written for organizations that run authentication systems, but they are a useful guide for personal passwords as well. For the same reason, treat the character-type checklist in this tool as a helpful hint, not the goal.

• Using personal information. Names, birth dates, pet names, addresses, and other personal details are the first things a targeted attacker will try. Even if mixed with other characters, personal information dramatically reduces the search space for someone who knows anything about you.

• Reusing passwords across accounts. Password reuse is one of the most dangerous practices in digital security. When one service is breached and its passwords are exposed (which happens regularly), attackers use those credentials to try to log in to other services automatically. This is called credential stuffing. A strong unique password for one account only protects that account.

• Using common passwords. The most common passwords are tested first in every attack. They include: 123456, password, 123456789, 12345678, 12345, 1234567, password1, 123123, admin, and qwerty. These appear verbatim on compromised password lists and are never acceptable.

• Using keyboard patterns. qwerty, asdfgh, zxcvbn, qweasdzxc, and similar keyboard walk patterns are well-known to attackers and appear in all serious password dictionaries.

• Predictable structures. Word + number + symbol at the end (Sunshine123!) follows a pattern that attackers test systematically. Capitalizing only the first letter is another predictable pattern. These structures pass naive complexity checkers but fail against real attacks.

• Password too short. Even with all character types, an 8-character password is increasingly vulnerable to brute force as hardware speeds increase. Twelve or more characters is a common recommended minimum for important accounts, and longer is better.

• Slight variations on old passwords. When required to change a password, many people increment a number or change one character (Password1 becomes Password2, then Password3). Attackers who have compromised an account once will test these variants first.

The most secure passwords are randomly generated by a password manager and never typed or remembered. However, for passwords that must be memorized (a master password for a password manager, a device login password), these strategies produce both strength and memorability.

The random word method (Diceware)

Diceware is a technique for generating passphrases by rolling dice to select words from a numbered word list. Four to six randomly selected words from a 7,776-word list (requiring five dice rolls per word) produce passphrases that are both highly secure and memorable because they are actual words.

A four-word Diceware passphrase has approximately 51 bits of entropy. A five-word passphrase has approximately 64 bits of entropy. A six-word passphrase has approximately 77 bits. These are genuinely strong for most purposes, especially since they can be remembered without writing them down. The words must be picked randomly (by dice or a generator), not chosen by you.

The sentence method

Take a memorable sentence and use the first letter of each word, incorporating natural capitalization, numbers, and punctuation. "I bought my first car in 2019 for twelve thousand dollars!" becomes "Ibmfci2019f12td!" This is 16 characters with all four character types and no dictionary word. This method is only as strong as the sentence is private, and it is generally weaker than a random passphrase of the same length.

Avoid common memory aids

Do not use memorable dates, lyrics from well-known songs, sports teams, or other culturally common phrases. The sentence method is strong only when the source sentence is personal and not publicly known.

Use a password manager

The most practical solution for the vast majority of users is a reputable password manager (Bitwarden, 1Password, Dashlane, KeePass) that generates, stores, and fills in strong random passwords for every account. The user needs only one strong master password. This eliminates the memorability constraint for all other passwords. Turn on two-factor authentication wherever it is offered.

Understanding how websites store passwords explains why a strong password matters even when a site is breached.

• Hashing: Websites should never store passwords in plain text. Instead, they store the result of running the password through a one-way cryptographic hash function. When you log in, the system hashes your entered password and compares it to the stored hash. bcrypt, scrypt, Argon2, and PBKDF2 are designed specifically for password hashing and are intentionally slow to compute, making brute-force attacks against the stored hashes more time-consuming. MD5 and SHA-1, while still used in some contexts, are too fast for password hashing and should not be used for this purpose.

• Salting: A salt is a unique random value added to each password before hashing. Salting ensures that two users with the same password have different hashes, preventing attackers from using precomputed hash tables (rainbow tables) to crack multiple passwords simultaneously.

• What happens in a breach: When a site's password database is breached, attackers obtain the hashed (and ideally salted) passwords. They then attempt to crack these hashes offline using brute force or dictionary attacks. Weak passwords (short, common, or following predictable patterns) are cracked quickly. Strong passwords may be computationally infeasible to crack even with the hash in hand. This is why a strong password protects you even if a site you use is breached.

• Plain text storage: Some websites (particularly smaller or older ones) do store passwords in plain text. If such a site is breached, all passwords are immediately exposed regardless of their strength. This is another reason to use unique passwords for every account: if one site leaks your plain text password, it only exposes that one account.

Thetoolity brings together a growing collection of free, fast, and clean online tools for anyone who wants to understand and improve their digital security. Our password strength checker provides real-time feedback on password strength and actionable improvement suggestions, with the analysis running in your browser.

No accounts. No subscriptions. No cluttered interfaces. Just a clean, instant password strength check.

Explore the full collection at Thetoolity.com and find generators, converters, calculators, checkers, and testers, all free and all instant.