Password Strength Checker
Poor
Weak
Better
Strong
How to check a password
Type the password in the field. Each rule it passes turns green, and the bar fills one step for each rule passed, from Poor to Strong. Click the eye icon to show the password while you type.
The checker tests five rules and nothing else. It cannot tell whether a password has leaked or can be guessed from facts about you, so treat a full bar as a minimum, not a guarantee. To check whether a password appears in known breaches, use Pwned Passwords on Have I Been Pwned.
The five rules the checker tests
The checker looks for lowercase letters, uppercase letters and special characters, and checks whether the password is at least 8 and at least 13 characters long. Letters means a to z and A to Z, so å or É counts for neither rule. Special characters are the space and most ASCII punctuation, from ! and @ to [ and _; the four characters { } | ~ do not count. Digits do not count as special characters either, and there is no separate rule for them.
The bar has four steps: Poor, Weak, Better and Strong. Each rule passed fills one step, so any four of the five rules give Strong.
What makes a password hard to guess
A good password is long, is used for one account only, and is not built from words or facts that an attacker would try first. A password manager makes that practical: it creates a different random password for every account and fills it in for you. For a password you have to remember, string together four or five words picked at random, for example with the random word generator on Lime Convert, our sister site.
Checks before you use a password
- At least 13 characters, the longest rule this checker tests, and 15 or more where the password alone opens the account, as NIST SP 800-63B asks of websites
- Uppercase and lowercase letters, numbers and symbols such as !@#$%^&*
- Not a dictionary word or a common phrase on its own
- Not built from names, birthdays or the name of a pet
- Not used for any other account
Mistakes that make a password easy to guess
Swapping letters for look-alike symbols, as in "p@ssw0rd", adds little: password-cracking tools try those swaps automatically. Keyboard runs such as "qwerty", "123456" and "asdfgh" are among the first strings they try. A short password full of symbols is still short; a 6-character password from all 95 printable characters has far fewer combinations than 16 lowercase letters.
Reusing a password is the costliest mistake. When one site leaks its passwords, attackers try the same email and password on other sites. This is called credential stuffing, and a unique password per account stops it.
Password managers
A password manager creates, stores and fills in a different password for each account, so you remember only one master password. Make that one long, and turn on two-factor authentication for the manager itself.
Two-factor authentication
With two-factor authentication (2FA), logging in needs your password and a second thing you have: a phone, an authenticator app or a hardware key. A stolen password alone then does not open the account. Turn it on first for email, because a reset link for every other account goes there.
Your password stays in the browser
The five rules are tested with JavaScript inside this page. The password is never sent over the network and never stored, not even in your browser's local storage. To see for yourself, open the network tab of your browser's developer tools and type in the field. At most one request appears, about two seconds after the first keystroke: a usage count for Vercel Web Analytics that names this page. Open it and you will find no trace of the password.
More barcode tools
Print-ready UPC, EAN-13, ITF-14, Code 128 and Data Matrix at the GS1 size, one at a time or a whole list
Bulk calculate and validate check digits for GTIN-8/12/13/14, EAN, and UPC
Turn a GTIN into a Digital Link URL and QR code with batch, expiry and serial qualifiers
Convert a whole product catalogue to Digital Link URLs from a single paste, CSV and QR ZIP exports
Recover smudged or partially unreadable GTINs by marking unknown digits with ? or *
Decode paren, FNC1 or Digital Link input, with a breakdown card for each AI and an anatomy widget
Editable table with bulk operations, sort, filter, and round-trip export to CSV / paren / FNC1 / Digital Link / QR ZIP
Recover data from damaged, blurry, or partially destroyed QR codes with automatic image enhancement
Paste any code and find out what it is: GTIN, ISBN, SSCC, GLN, ITF-14, GS1-128, Digital Link, VIN, IMEI, or ASIN
Convert between ISBN-10 and ISBN-13 with recomputed check digits, hyphenation, and a clear explanation when conversion is not possible
Frequently asked questions
Is my password sent to a server?
No. The checker is a few lines of JavaScript that test the password in your browser as you type. The password is not sent over the network, not written to browser storage and not kept after you close the tab. Once per visit, about two seconds after you start typing, the page sends one usage count to Vercel Web Analytics. It names this page and holds nothing you typed.
What makes a password hard to guess?
Length, and being used for one account only. A long password made of several unrelated words is hard to guess and easy to type. Avoid dictionary words on their own, names, birthdays and keyboard runs such as qwerty. A password manager can create and remember a different random password for every account, so a leak at one site does not open the others.
Is password length or complexity more important?
Length. A 16-character password of lowercase letters alone has 26 to the power 16, about 4 x 10^22, possible combinations. A 6-character password drawn from all 95 printable ASCII characters has 95 to the power 6, about 7 x 10^11. Each extra character multiplies the number of combinations an attacker has to try, so adding length beats adding symbols.
What are the five rules this checker tests?
Lowercase letters a to z, uppercase letters A to Z, special characters, a length of at least 8 and a length of at least 13. Special characters here means the space and most ASCII punctuation; digits, { } | ~ and accented letters such as é do not count, and there is no separate rule for digits. The bar has four steps, so a password that passes any four rules shows as Strong.
Do numbers make a password stronger?
A little, and this checker does not reward them: it has no rule for digits. A random extra character multiplies the number of combinations by the size of the set it comes from, 10 for a digit and 26 for a lowercase letter, so a random letter adds more than a random digit. A digit or a year at the end of a word adds least, because guessing tools try that pattern early.
Is a passphrase better than a password?
Yes, when the words are picked at random. Four or five unrelated words are long and easy to type, and length is what makes guessing slow. Words that belong together, a song line or a quote are guessed much sooner. Four random lowercase words with spaces between them pass four of this checker's rules: lowercase, special characters (the space) and both lengths. The bar shows Strong.
Should I change my password regularly?
No, not on a schedule. NIST Special Publication 800-63B, the US government's guidance on passwords, tells websites not to force periodic changes and to force a change only when there is evidence the password has been compromised. Change it at once when a site you use reports a breach, when you get a sign-in alert you did not cause, or when you used the same password on a site that leaked.
How do I find out whether my password has leaked?
Check it with Pwned Passwords on Have I Been Pwned. Your browser hashes the password with SHA-1 and sends only the first five characters of the hash; the service answers with every leaked hash that starts the same way, and the match is made on your device. A hit means the password is in breach data and should not be used anywhere. No hit does not make it strong.