What this checker works out
This checker reports a password's length, an estimated entropy in bits, and a plain assessment — with length treated as the dominant factor, because it is.
Nothing you type leaves your browser. There is no network request; the calculation runs entirely on your own device. Even so, the checker cannot tell you the two things that matter most, which are covered below.
Enter your details
What this cannot tell you
- Whether the password has appeared in a data breach. A password in a breach list is compromised regardless of how strong it looks.
- Whether you have used it anywhere else. Reuse is what turns one breach into many compromised accounts.
- Entropy assumes random selection, which human-chosen passwords are not — a dictionary word with substitutions scores far higher here than it deserves.
- Whether the account has two-factor authentication, which protects an account far more than password strength does.
Current NCSC guidance moves away from composition rules — the demand for an uppercase letter, a digit and a symbol — because they produce predictable passwords that are hard for people and easy for machines. Three random words are longer, more memorable and stronger than a short password with substitutions. The recommendation is length, uniqueness and a password manager, not character variety.
How this calculator works
Length against the character set in use:
Character set = 26 lowercase + 26 uppercase + 10 digits + 33 symbols, counting only those present
Entropy in bits ≈ length × log₂(character set size)
Under 12 characters — too short · under 60 bits — weak · under 80 — reasonable · above — strongThe length threshold overrides the entropy band, because a short password with a large character set is still short. A brute-force attack is bounded by length far more than by which characters appear.
The entropy figure assumes random selection. A password chosen by a person from a predictable pattern has far less real entropy than the arithmetic suggests, which is why the assessment should be read as a ceiling.
Worked example: three passwords
Three examples, all commonly considered strong:
- Password1! — 10 characters, 66 bits, too short
- Tr0ub4dor&3 — 11 characters, 72 bits, too short
- correcthorsebatterystaple — 25 characters, 118 bits, strong
The first two satisfy every composition rule ever written and are both weak. The third uses only lowercase letters, satisfies almost none of them, and is far stronger — because it is more than twice as long. That comparison is the entire argument for passphrases, and it is why the old rules have been abandoned.
Common mistakes
- Reusing a password across accounts. One breach then compromises all of them.
- Substituting characters in a dictionary word. Attack tools try those substitutions first.
- Changing passwords on a schedule. Current guidance advises against it; it produces weaker, predictable variations.
- Relying on password strength alone. Two-factor authentication protects an account far more.
- Typing a real password into an unfamiliar website. This one runs locally; most cannot be verified.
Frequently asked questions
What makes a good password?
Length, uniqueness and randomness. The NCSC recommends three random words for passwords you must remember, and a password manager generating long random strings for everything else. What matters is that it is long, used for one account only, and not derived from something guessable about you.
Should I use a password manager?
For most people, yes — it is the single change that most improves account security. It generates long unique passwords, remembers them, and removes the reuse that makes breaches cascade. The master password becomes the one you must get right, and that is where three random words belongs.
How do I know if a password has been breached?
Reputable breach-checking services let you check an address or password against known breaches, and most password managers and browsers now do this automatically. The check should use a method that does not send the full password — established services use a partial-hash approach for exactly this reason.
Should I change passwords regularly?
Current NCSC guidance advises against routine expiry. Forced regular changes lead people to make small predictable modifications, which weakens rather than strengthens. Change a password when there is a reason — a breach, a suspicion, or a shared password no longer being appropriate.
Is what I type stored?
No, and this matters more here than anywhere else on the site. The calculation runs entirely in your browser with no network request, and nothing is transmitted or retained. As a general habit, though, entering real passwords into websites is worth avoiding — most cannot be verified the way you can verify this one by disconnecting from the internet and watching it still work.
Related tools
References
- National Cyber Security Centre — password guidance, three random words and advice against routine expiry
- Information Commissioner's Office — security obligations for personal data and account protection
Sources are checked at publication and can change — how I choose and check references.