Password Strength Checker
Test how strong your password is. See entropy, estimated crack time and tips to make it stronger. Free, and your password never leaves your browser.
Time to Crack
0s
Length
0 Chars
Local Analysis
Analyzed locally. Your data never leaves this device.
About this tool
Type a password and see its real security posture: entropy, estimated crack time, and specific weaknesses, updated live with each character. Security-conscious users test candidates before committing them, and IT teams use the crack-time estimates to make password policy debates concrete instead of theoretical.
How to Test Password Strength
- 1
Type a candidate password into the checker — analysis happens locally, so testing a real password is safe here in a way it isn't on most sites.
- 2
Read the live feedback: entropy measurement, estimated time to crack under realistic attack speeds, and which factors (length, character variety, patterns) help or hurt.
- 3
Adjust the candidate — usually by lengthening it — until the estimate reaches a timescale you're comfortable with, then set it wherever it's needed.
Why Check Strength with Wrklyst
- Tested Without Transmitting
- The analysis runs in your browser's memory and nothing is logged or sent — the non-negotiable requirement for a tool you type real passwords into.
- Numbers, Not Adjectives
- Instead of a vague 'medium' badge, you get entropy bits and crack-time estimates you can actually reason about.
- Free to Iterate
- Test twenty variations in a minute — no account, and no record that you ever did.
Stronger Passwords, Practically
- Fix length first — going from 8 to 14 characters helps more than any symbol sprinkling.
- Never reuse across sites; strength is irrelevant once one breached site leaks it everywhere.
- A password manager plus generated passwords beats memorization for everything except your master password.
- For the master password, use a 4–5 word random passphrase — strong and actually memorable.
Frequently asked questions
What is password entropy?
A measure, in bits, of how many guesses an attacker needs on average — each additional bit doubles the search space. It grows with length and the size of the character set used. As rough anchors: under 40 bits falls quickly, 60+ resists casual attack, and 80+ withstands serious offline cracking.
How are crack-time estimates calculated?
By dividing the guess space by realistic attacker speeds — modern GPU rigs test billions of hashes per second offline. The estimate assumes the attacker knows your password's length and character classes, which is the honest worst case. Online attacks with rate limiting are far slower; the estimate guards against the stolen-database scenario.
Is a long simple password better than a short complex one?
Almost always yes — length beats complexity because each added character multiplies the search space, while swapping a for @ barely helps (crackers try those substitutions first). Four random common words outperform 'P@ssw0rd!' by orders of magnitude while being easier to remember. Length first, complexity second.
Why does a password with symbols still score poorly?
Because patterns undo character variety: 'Summer2026!' uses three character classes but follows the word-year-symbol template crackers try within the first seconds. Dictionary words, keyboard walks, dates, and predictable substitutions all collapse the effective search space regardless of which characters appear.