What is compare mode?

Compare mode renders two independent score panels side by side , each with its own input, highlights, penalties, and suggestions. Use it to decide between two candidate passwords — for example a memorable passphrase vs. a random string, or an old password vs. its proposed replacement — and see concretely which one has higher entropy and fewer weak patterns.

Is this strength checker free and private?

Yes. All analysis runs entirely in your browser using JavaScript. Your password is never sent to any server, stored in a database, or logged. The only network request the whole flow can make is the optional breach check, which sends just 5 characters of a SHA-1 hash prefix to Have I Been Pwned — the password itself is never transmitted.

Password Strength Checker — How Strong Is Your Password?

This password strength checker highlights the weak parts of a password, explains how the score is worked out, and can hand your password to the breach checker to see whether it has appeared in known breaches. Compare two candidates side by side — or find a fresh one with the Password Generator and dig into the math with the Entropy Calculator.

Single password analysis

Highlighted weak patterns appear when you reveal the password.

Password

0Very Weak

Entropy

0.0 bits

Length

0 chars

Crack Time

Instant

Effective pool/char

—

Suggestions

Enter a password above to get personalized tips.

What is Password Strength Checker?

A password strength checker evaluates how resistant a password is to guessing attacks like brute-force and dictionary attacks. It provides a visual score, highlights the exact weak substrings, and shows the math behind every deduction.

Entropy-based scoring — measures randomness in bits, factoring in character variety, length, and patterns.

Pattern highlighting — colored highlights reveal exactly which substrings are weak: common breached passwords, dictionary words, repeats, sequences, keyboard walks, and years.

Transparent scoring — the "How was this scored?" panel shows the strength mapping and every penalty applied.

Breach deep-link — one click hands your password to the Breach Checker (privacy-safe, never in the URL).

Compare mode — score two passwords side by side to see which is stronger.

Zero-Server Tool Data Guarantee

Your password is analyzed entirely in your browser. It is never sent to any server or stored anywhere. The breach check sends only the first 5 characters of your password's SHA-1 hash (k-anonymity).

How to Use

Enter Your Password

Type or paste the password you want to check into the input field. Use the eye icon to reveal it and see highlighted weak patterns.

Review the Strength

Check the color-coded strength circle and the label (e.g., 'Strong', 'Weak') to see how your password performs.

Inspect the Pattern Breakdown

Reveal the password to see colored highlights, then read the Pattern Breakdown table for the exact weak substrings and why they matter.

Understand the Score

Click 'How was this scored?' to see the strength mapping and every penalty that was applied to your entropy estimate.

Check for Breaches

Click 'Check breaches' to hand your password to the Breach Checker — only a hash prefix ever leaves your browser.

Follow Suggestions

Look at the suggestions section for personalized tips on how to make your password even more secure.

Common Use Cases

Audit Existing Passwords

Check passwords you're currently using across accounts. Replace any that score 'Weak' or 'Fair' immediately.

Test New Passwords

Before adopting a new password, run it through the checker to ensure it meets a high entropy threshold.

Teach Good Habits

Show family members or colleagues the highlighted substrings to explain why patterns and dictionary words are dangerous.

Pick the Stronger Option

Use compare mode to decide between two candidate passwords — e.g. a memorable passphrase vs. a random string.

Compliance Verification

Verify that generated passwords meet your organization's minimum strength requirements.

Implementation Examples

JavaScriptBasic Entropy Calculation

function estimateEntropy(password) {
    let poolSize = 0;
    if (/[a-z]/.test(password)) poolSize += 26;
    if (/[A-Z]/.test(password)) poolSize += 26;
    if (/[0-9]/.test(password)) poolSize += 10;
    if (/[^a-zA-Z0-9]/.test(password)) poolSize += 33;
    return password.length * Math.log2(poolSize || 1);
}

const entropy = estimateEntropy("MyP@ssw0rd!");
// ~72 bits

Password Strength Levels

Entropy (bits)	Strength Label	Example Crack Time	Recommendation
< 28	Very Weak	Instant	Do not use
28–35	Weak	Instant – ~30 sec	Replace immediately
36–59	Fair	Minutes to years	Improve with more length/variety
60–89	Strong	Decades to centuries	Good — use this level
90+	Very Strong	Centuries+	Excellent for encryption keys

Production Best Practices & Security

Aim for 60+ bits of entropy — at 1 billion guesses per second it takes roughly 37 years, and 90+ bits is effectively unbreakable. Why:Entropy measures a password's randomness. Every extra bit doubles the work an attacker must do, so 60 bits is a practical, achievable target that makes offline cracking uneconomical.

Length matters most — a 20-character lowercase-only password is often stronger than an 8-character mixed-case one. Why:In the math of passwords, length increases complexity exponentially, while adding more character types (uppercase, symbols) only increases it linearly.

Let the highlights guide you — every colored substring in the password is a weakness an attacker would try. Replace or remove those substrings rather than just lengthening the password. Why:Attackers use wordlists and pattern dictionaries before brute force; a highlighted "password" or "qwerty" inside a long string is still crackable.

Use a password manager — it generates and remembers strong, unique passwords for every account. Why:Humans are naturally bad at being random and good at being predictable. A password manager removes the "human element" from password creation.

Never reuse passwords — if one site is breached, all accounts with the same password are at risk. Why:Attackers use "Credential Stuffing" — they take lists of leaked emails and passwords and try them on every other major website automatically.

Check existing passwords for breaches — use the breach deep-link to verify a password hasn't already leaked. Why:Even a mathematically strong password is worthless if it already appears in a public breach list.

Frequently Asked Questions

When you reveal the password with the eye icon, every weak substring is highlighted with a color-coded mark:

Red = one of the most commonly used and widely cracked passwords, orange = a common English dictionary word, amber = repeated characters, blue = sequential characters like abc or 123, violet = keyboard walks like qwerty, pink = calendar years.

Each of these is something an attacker tries before brute-forcing every combination. Removing or replacing every highlighted substring is the fastest way to improve a password's real strength.

The checker starts from base entropy = length × log2(pool_size), where the pool is the set of character types your password uses (lowercase, uppercase, digits, symbols).

It then applies penalties for every weakness found: breached passwords, dictionary words, symbol-substituted words like p@ssw0rd, repeats, sequences, keyboard patterns, and years. Clicking 'How was this scored?' shows the entropy-to-score mapping (based on practical strength bands) and a line-by-line list of every penalty factor applied, so the number is fully auditable rather than a black box.

Crack time uses 2^entropy / guesses_per_second, assuming 1 billion guesses per second (a realistic modern offline-attack rate).

Each extra bit of entropy doubles the guesses an attacker must try. A password under 20 bits cracks instantly; 60 bits takes around 37 years, and 90+ bits reaches centuries. The estimate is based on your effective entropy — after pattern penalties are applied — so weaknesses like password123 or qwerty already drag the crack time down before you even review the highlights.

The breach check hands your password to the Breach Checker tool using a privacy-safe handoff: your password is stored in browser session storage (never in the URL, never on a server) and the Breach Checker computes its SHA-1 hash, sends only the first 5 hash characters to the Have I Been Pwned API (k-anonymity), and reports the number of times the full hash appears in known breach data.

Even a mathematically strong password is worthless if it already appears in a public breach — a strong entropy score and a breach match are two independent risks to check.