Password Strength Checker

A password strength checker estimates how resistant a password is to cracking — analyzing length, character variety and predictable patterns to gauge roughly how long an attacker would need to guess it. The headline output is intuitive: "instantly", "3 hours", "centuries".

The single biggest factor is length, not complexity: an attacker's guessing time grows exponentially with each character but only linearly with a bigger character set. "correct-horse-battery-staple" (long, memorable) crushes "P@ss1!" (short, "complex") — a truth this checker makes visible, and one most password rules get backwards.

Type a password and see its estimated strength and crack time, with the weaknesses that drag it down flagged — all computed in your browser, never transmitted.

What actually makes a password strong: length above all (aim for 16+ characters — every added character multiplies the search space; a 16-character password is astronomically stronger than an 8-character one regardless of symbols); unpredictability (dictionary words, names, dates, keyboard walks like "qwerty" and leetspeak substitutions ("P@ssw0rd") are all in every cracking wordlist — the checker penalizes them because attackers try them first); and uniqueness per site (the strongest password is worthless if reused — one breach exposes every account sharing it).

The real-world advice the checker points toward: use a password manager to generate and store long random passwords (you remember one master, it handles the rest), and enable two-factor authentication everywhere — even a cracked password fails against 2FA. For memorable manual passwords, a random four-to-five-word passphrase beats any "complex" short string. Testing here is safe: nothing you type leaves your device.