What is a password strength checker?
A password strength checker estimates how hard a password would be to guess. This one tests a password against seven rules covering length, character variety and repeated characters, shows which rules pass, and turns the count into a rating from Very weak to Very strong. It runs entirely in your browser and updates as you type.
Treat the result as a quick sanity check, not a guarantee. The rules look at the shape of a password, and they can't see whether it's a word, a name or a password that's already been leaked.
How to check a password
- Type or paste the password into the input box.
- Read the rating and the list of checks in the output. It refreshes on every keystroke, and Check runs it again manually.
- Fix whatever fails, or better, replace the password with a random one.
How the score works
Each rule that passes adds one point, out of 7:
| Rule | Passes when |
|---|---|
| At least 8 characters | Length is 8 or more |
| At least 12 characters | Length is 12 or more |
| Contains lowercase letters | Includes a–z |
| Contains uppercase letters | Includes A–Z |
| Contains numbers | Includes 0–9 |
| Contains symbols | Includes anything other than A–Z, a–z and 0–9 (spaces count) |
| No 3+ repeated characters in a row | Nothing like aaa or 111 |
The points map to a rating: 0–2 is Very weak, 3–4 Weak, 5 Moderate, 6 Strong and 7 Very strong.
Here's how some real inputs score:
| Password | Score | Rating | What it misses |
|---|---|---|---|
abc |
2/7 | Very weak | Length, uppercase, numbers, symbols |
password |
3/7 | Weak | 12+ length, uppercase, numbers, symbols |
correct horse battery staple |
5/7 | Moderate | Uppercase, numbers |
Password1! |
6/7 | Strong | 12+ length |
aaaBBB111!!! |
6/7 | Strong | Repeated characters |
P@ssw0rd2026 |
7/7 | Very strong | Nothing |
kX9#mQ2$vL7p |
7/7 | Very strong | Nothing |
The last two rows show the limit of any rule-based checker. P@ssw0rd2026 gets a perfect score, yet it's "password" with predictable letter swaps and a year added, exactly the kind of pattern cracking tools try early. kX9#mQ2$vL7p gets the same score and is genuinely random.
What the score can't tell you
Real attackers don't try every combination in order. They start with lists of leaked passwords, dictionary words, names, keyboard patterns like qwerty, and common substitutions like @ for a. A password that fits those patterns falls quickly, however many character types it uses.
The U.S. National Institute of Standards and Technology makes the same point in its digital identity guidelines, NIST SP 800-63B. It notes that people respond to composition rules predictably, turning "password" into "Password1" or "Password1!", and it tells services to:
- check new passwords against a blocklist of commonly used, expected or compromised passwords,
- require at least 15 characters when a password is the only factor (8 with multi-factor authentication),
- not impose composition rules such as "must include a symbol".
So a good result here is necessary but not sufficient. To check whether a specific password has already turned up in a breach, services such as Have I Been Pwned's Pwned Passwords compare it against a large collection of passwords exposed in real breaches. Only do that for passwords you're about to retire, or use a password manager with breach monitoring built in.
How to get a password that's actually strong
The reliable approach is to stop choosing passwords yourself:
- Generate a long random password with the password generator. A 16-character password from all four sets will usually score 7/7 here, and more importantly it's random.
- Store it in a password manager so you never have to remember or reuse it.
- Turn on multi-factor authentication for important accounts, starting with your email.
If you'd rather use a passphrase you can type, make it at least four or five random words chosen by a generator, not a phrase you thought of. It may only rate Moderate here because it lacks uppercase and numbers, but its length is what protects it.
For developers: passwords should be stored with a slow, salted algorithm such as bcrypt, scrypt or Argon2, never a fast hash. The hash generator is for checksums and comparing files, and the UUID generator is the better choice when you need a random identifier rather than a secret.
Last updated