Password Strength Checker

How the seven points are awarded

The score starts at zero and adds one point for each rule the text meets. Length of 8 or more is one point. Length of 12 or more is a second point. Length of 16 or more is a third point. Those three can all apply at once, so a 16-character password already has three length points before any character class. A lowercase letter a through z adds one. An uppercase letter A through Z adds one. A digit 0 through 9 adds one. Any other character adds one. The maximum is 7. Correct-Horse1 is 14 characters, so it receives the 8 and 12 points but not the 16 point, plus all four classes, for a score of 6.

The level is the score divided by 1.5, rounded down, and capped at 4. Scores 0 and 1 are Very Weak. Score 2 is Weak. Scores 3 and 4 are Fair. Score 5 is Strong. Scores 6 and 7 are Very Strong. The bar width is the score divided by 7, rounded to a percent. Score 1 is 14 percent, score 2 is 29, score 4 is 57, score 5 is 71, score 6 is 86, and score 7 is 100. Very Strong is therefore not always a full bar. The bar colors are red, orange, yellow, lime, and green in level order. They do not change the score.

The field, the bar, and the suggestion list

Password to check is a password input with autocomplete off. Show and Hide flip the type between password and text. The button's accessible name matches that action. Nothing runs on a delay. Each change rebuilds the panel. Clearing the box removes the panel entirely, including the bar, and Copy output then has an empty analysis. A single space is enough to show the panel, because a space is not an empty string.

Suggestions are printed only in the Analysis block, as bullet lines. Length under 8 adds Use at least 8 characters. Length under 12 adds 12+ characters is recommended. A missing lowercase letter, uppercase letter, digit, or symbol adds Add lowercase letters., Add uppercase letters., Add numbers., or Add symbols (e.g. !@#$%). Three or more of the same character in a row adds Avoid repeated characters. When none of those fire, the block ends with No suggestions — great password! The word password, eight lowercase letters, is Weak with score 2 and 37.6 bits, and the list asks for 12 characters, uppercase, numbers, and symbols. It does not say the word is common.

What this score will not tell you

Entropy here is length times the base-2 log of a class size. Lowercase contributes 26, uppercase 26, digits 10, and the symbol class 32, and only the classes that appear are added. Correct-Horse1 uses all four, so the class size is 94 and 14 times log2(94) prints as 91.8 bits. The 32 is a fixed assumption. It is not the number of distinct symbols you typed, and repeats do not reduce the figure. Abcdefg1! is nine characters, score 5, Strong, 59.0 bits, with the single suggestion 12+ characters is recommended.

The password generator draws from its own symbol list of 26 characters and can drop 0, O, 1, l, and I. This checker does not know that list. A symbol here is any character outside letters and digits, including a space, an accented letter, or a hyphen. A string that should be random rather than scored belongs on the random string generator. This page does not hash the password. A digest you already have is a job for the hash identifier, not for this score.

Repeats, spaces, and letters outside A to Z

Avoid repeated characters looks for one character three times in a row. aa does not match. aaa does. The point total ignores that pattern. Aaaa1!aaaa1!aaaa is 16 characters with every class and a run of a's, so the score is 7, the level is Very Strong, the bar is full, entropy prints as 104.9 bits, and the only suggestion is Avoid repeated characters. A Very Strong label can sit next to a warning.

A space counts as a symbol and as length. One space is Very Weak, score 1, 5.0 bits, and the list asks for length, lowercase, uppercase, and numbers. It does not ask for a symbol. Letters outside A through Z, such as é or Ω, also take the symbol point rather than the letter points. The page never queries a dictionary, a keyboard walk, or a breach list. hunter2 is Weak, score 2, 36.2 bits, because it is seven characters with a lowercase letter and a digit. The fame of the word is not an input.

Rules and limitations

Points: one each for length at least 8, 12, and 16, and one each for a lowercase letter, an uppercase letter, a digit, and any other character. Level bands are 0–1 Very Weak, 2 Weak, 3–4 Fair, 5 Strong, 6–7 Very Strong. The bar is the score divided by 7.

Entropy is length times log base 2 of 26, 52, 62, or 94, depending on which classes appear. The symbol class always adds 32. Repeats add a suggestion and do not change the score. An empty box hides the panel. Copy output copies the Analysis text.

Common problems

If a famous word scored higher than you expected, the page is counting classes and length only. It will not subtract points for a dictionary word.

If Very Strong still lists Avoid repeated characters, three identical characters are in a row. The level does not suppress that line. If the panel vanished, the box is empty again.

Frequently asked questions

About this tool

Maintained by Toolbench. For large or deeply nested files, split the input into smaller batches and verify representative results before using them in an import or application. Report reproducible problems through Contact.