Password strength checker
Type a password to see how strong it really is. The checker spots the patterns that cracking tools try first, such as common passwords, words, keyboard walks and dates, and shows how long an attacker would need. Your password stays in your browser.
Free · No sign-up
How to use it
- Type or paste a password in the box. Press Show if you want to see what you typed.
- Read the strength level, the estimated time to crack and the checklist.
- Look at the warnings and at how an attacker would split your password into guessable parts, then follow the tips.
- Optionally press Check for data breaches to see if the password has appeared in known leaks, or let the tool suggest a strong random password.
Why use this tool
Realistic estimate
Rates passwords the way cracking tools attack them, so P@ssw0rd2024! is rated weak even though it ticks every box.
Crack times for 4 attacks
From a website that limits login attempts to a stolen database cracked on fast graphics cards.
Clear warnings and tips
Shows the exact weak parts, such as a common word, a keyboard walk or a year, and how to fix them.
Safe breach check
Optional check against hundreds of millions of leaked passwords using k-anonymity, so your password never leaves the device.
Strong password generator
One click creates an 18-character random password with the browser's secure random generator.
Private
No sign-up, no tracking of what you type, and no password is sent to Amanta AI.
What makes a password strong?
Length and unpredictability. Attackers do not try every combination in order. They start with leaked passwords, dictionary words, names, dates and keyboard patterns, then add common changes such as a capital first letter, a number at the end or @ instead of a.
A password made of real randomness, or of several unrelated random words, cannot be found this way. Each extra random character or word multiplies the work for the attacker.
Password examples
| Password | Rating | Why |
|---|---|---|
| password123 | Very weak | In every list of common passwords |
| Summer2025! | Fair | A common word, a year and a symbol at the end |
| P@ssw0rd | Very weak | A famous password with predictable swaps |
| correct horse battery staple | Very strong | Four unrelated words, 28 characters |
| fM#UgjBYxv-*68@Q9 | Very strong | 17 truly random characters |
Tips for safer passwords
- Use a different password for every account, so one leak does not open the others.
- Let a password manager create and remember long random passwords for you.
- For passwords you must remember, use a passphrase of 4 to 6 random words.
- Turn on two-factor authentication, ideally with an app or a security key.
- Change a password at once if it appears in a data breach.
How the estimate works
The checker splits your password into the cheapest set of parts an attacker would guess: entries from a list of 10,000 common passwords, sequences, keyboard walks, repeats, years and dates. Anything left over is counted as random characters. Multiplying the guesses for each part gives the total number of guesses, and crack times assume the attacker finds the password after trying half of them.
The breach check uses the Have I Been Pwned range API. Your browser hashes the password with SHA-1 and sends only the first 5 characters of the hash. The service returns all leaked hashes starting with those characters, and the match is made on your device.
Frequently asked questions
Is it safe to type my real password here?
The check runs entirely in your browser and the password is not sent or stored. Even so, the safest habit is to test a password that is similar to yours, not the exact one you use for important accounts.
How long should a password be?
At least 12 characters for everyday accounts, and 16 or more for email, banking and password manager master passwords. Length helps more than adding one symbol.
Why is my password weak even though it has symbols and numbers?
Attackers try common words with predictable changes first, such as a capital letter at the start, a year at the end and @ for a. These follow rules that cracking tools know, so they add very little strength.
How does the data breach check protect my password?
Only the first 5 characters of the SHA-1 hash are sent to Have I Been Pwned. Hundreds of different hashes share those 5 characters, so the service cannot tell which password you checked.
What does entropy in bits mean?
It is the number of guesses written as a power of 2. Every extra bit doubles the guesses needed. Around 60 bits is strong for online accounts, and 80 bits or more resists offline attacks.
Are the crack times exact?
No, they are estimates. Real speed depends on how the website stores passwords and on the attacker's hardware. Use them to compare passwords, not as a guarantee.
How to create a strong password
Related tools
Need something built?
Tell us what you want to create.
Tell us what you need built, from a simple website to a complete app, AI solution, automation, or custom system.