Password Strength Analyser

Analyse a password

What the analyser checks

The feedback is based on measurable properties of the password you enter. It does not check against breach databases (see the Breach Check guide for that).

Length

Length is the single most impactful factor in password strength. Each additional character multiplies the number of possible values by the size of the character set. A 12-character password drawn from a 94-character set has roughly 79 bits of entropy; adding just four more characters raises that to 105 bits.

Character classes

Using lowercase, uppercase, digits, and symbols increases the size of the character pool. A pool of 26 (lowercase only) gives each position roughly 4.7 bits; expanding to 94 (all classes) gives roughly 6.5 bits — a modest gain per character, but it compounds across length.

Patterns

Repeated characters, sequential runs (123, abc), and structural patterns (Capital + word + numbers + symbol at the end) are flagged because attackers test these first. Password-cracking rulesets specifically target common structures, so a patterned 12-character password is often easier to crack than an unpatterned 10-character one.

Entropy estimate

Entropy is expressed in bits: log₂(charset_size^length). It represents the theoretical cost to brute-force the password given no knowledge beyond the character set used. The estimate is conservative — if your password contains predictable words or patterns, the real attackable entropy is lower.

Disclaimer: This tool provides an indicative assessment based on structural properties. No security guarantee is implied. A password marked "Very Strong" by this analyser may still appear in a breach database if you have used it on a compromised site.