Updated · Built and checked by the PlinzoTools team, formulas tested against published sources
Check a password's real strength: spots common words, look-alike swaps, sequences, keyboard patterns and years, with crack-time estimates.
Checked entirely in your browser -- the password is never sent or stored anywhere.
Type a password to see its strength, the patterns that weaken it, and how long it would take to crack.
This tool estimates how hard a password would be to crack -- not just by counting character types, but by spotting the shortcuts real cracking tools take. It recognizes common passwords and words (including reversed, capitalized and "p@ssw0rd"-style look-alike versions), sequences such as abc or 9876, repeats, keyboard walks such as qwerty or asdf, and years. It reports the effective strength that remains, the patterns it found, and an average time to crack under four realistic attack scenarios. Everything runs in your browser; nothing is sent anywhere.
Type or paste a password. The meter, the strength label, the effective entropy and the crack-time table update as you type, with a note for every pattern found and every missing ingredient. Tick "Hide characters" if someone can see your screen.
First, brute force: each character is worth log2(character pool) bits, where the pool is 26 for lowercase, 26 for uppercase, 10 for digits and 32 for symbols. Then each recognized pattern is priced at what it costs an attacker who knows it: a common word is about 8 bits, a word from the EFF passphrase list 12.9 bits, a year 7.6 bits, a sequence or keyboard walk only a few bits. The tool picks the cheapest way to cover the whole password with patterns and brute-force characters. That total is the effective entropy, shown next to what it would be if every character were random.
| Label | Effective entropy | What it means |
|---|---|---|
| Very Weak | under 28 bits | Guessable in seconds to hours, even online |
| Weak | 28-39 bits | Falls quickly to an offline attack |
| Fair | 40-59 bits | Fine against online guessing, risky if a site's password database leaks |
| Strong | 60-79 bits | Resists offline attacks against slow hashes |
| Very Strong | 80 bits or more | Beyond practical brute force today |
To get a password that scores Very Strong every time, use the Password Generator.
Each figure is the average time to guess -- half the search space -- at a fixed rate:
Real rates vary widely with hardware and hash settings, so treat these as orders of magnitude, not promises. They also assume the attacker tries exactly the patterns this tool knows about. Attackers who work through large breach lists can find some passwords much faster.
This is a transparent model, not a guarantee. The built-in lists are short, so names, places, other languages' words and leaked passwords outside them are scored as random characters, and their strength is overstated. Separators between passphrase words are also counted as random characters. Keyboard detection covers row walks on a US layout, not diagonal patterns or other layouts. A password a person made up is almost always weaker than the formula alone suggests. A password chosen at random by a generator is the one case where the full brute-force figure is accurate.
No. The tool checks patterns and a short built-in list of the most common passwords, not the billions of passwords exposed in breaches. A password can score well and still be in a breach list, so use a breach-checking service such as Have I Been Pwned's password check as well.
No. The whole check runs in your browser and nothing is transmitted or stored. Even so, it's sensible to test a similar password rather than the exact one protecting your email or bank.
Because cracking tools try look-alike substitutions straight away. Swapping a for @ and o for 0 adds only a couple of bits, while the password is still the word "password" -- one of the most common passwords there is.
"If fully random" is length times bits per character, which assumes every character was chosen at random. Effective entropy is what remains after the patterns an attacker would try first are priced in. The bigger the gap, the more predictable the password.
Yes. Any character outside a-z, A-Z and 0-9 adds the 32-character symbol pool to the brute-force part of the estimate.
At least Strong, and Very Strong for important accounts. More importantly, use a unique password for every site, so one leak doesn't unlock the others.
It doesn't: the 12-character suggestion appears only when the password is shorter than 12 characters, whatever its score, because length is the most reliable way to add strength.
Reference: MDN Web Docs