Password Strength Checker
Type a password to see live entropy estimation, character variety, and common-password warnings, nothing is ever sent anywhere.
About the Password Strength Checker
Strength is estimated by calculating entropy, essentially bits of randomness, based on which character sets you use and how long the password is, then checking for common weak spots like sequential runs, repeated characters, and matches against a list of frequently used passwords. The check happens entirely in your browser, so whatever you type in never leaves the page.
The actual entropy formula, and what it assumes about you
The entropy calculation is log2(poolSize) × length, bits of randomness per character multiplied by how many characters you typed, where poolSize adds up 26 for uppercase, 26 for lowercase, 10 for digits, and 32 for symbols, but only for the character classes your password actually uses. This is the standard theoretical entropy formula, but it comes with a critical hidden assumption: it assumes every character was chosen independently and uniformly at random from that pool. Real human-chosen passwords almost never work that way, people pick dictionary words, names, dates, and predictable substitutions ("@" for "a", "0" for "o"), and this formula has no way to detect or penalize any of that. It measures theoretical randomness given the character classes present, not how guessable the actual pattern is.
Why the checker doesn't stop at the entropy number
Because raw entropy math can genuinely overstate the real strength of a predictable password, something like "P@ssw0rd1" scores reasonably under pure pool-size math despite being one of the first substitutions any real attacker's dictionary would try, this tool layers three separate, purpose-built pattern checks on top: an exact match against a list of known common passwords, a scan for sequential runs like "abc" or "123", and a scan for the same character repeated three or more times in a row. These heuristic checks exist specifically to catch the predictability that a pure entropy formula structurally cannot see.
An honest scope note on the common-password list
The built-in list contains around 30 of the most notoriously overused passwords, "password," "123456," "qwerty," and similar. It's a genuinely useful illustrative sample, but it isn't a comprehensive breach-data database of the millions of passwords that show up in real leaked-credential lists, services like Have I Been Pwned maintain far larger datasets for that specific purpose. A password that avoids this specific short list isn't automatically safe from real-world credential-stuffing attacks, it just isn't one of the handful of most infamous choices.
What the sequential and repeated-character checks do and don't catch
Sequential detection specifically looks for any three consecutive characters from the forward alphabet ("abc," "xyz") or forward digit sequence ("123," "789"), after lowercasing the input so it also catches uppercase runs like "ABC." It does not check for keyboard-adjacency patterns like "qwerty" or "asdf," or reversed sequences like "cba" or "321", those slip through this particular check, though "qwerty" specifically would still get caught separately by the common-password list. Repeated-character detection uses a regex backreference to flag any single character appearing three or more times in a direct row, like "aaa," but it won't flag alternating short patterns like "abab" or "121212," which are also weak but structurally different from a straight repeat.
Why the input stays in the same field when you click Show
Clicking Show/Hide simply toggles the input element's type attribute between password (which masks the characters) and text (which reveals them), it's the same underlying input and the same value throughout, nothing gets copied, cleared, or re-typed. That's worth knowing if you're demonstrating this tool or checking a password on a shared screen, toggling visibility never risks losing what you've typed or triggering a fresh analysis, since the analysis re-runs on every keystroke regardless of which display mode is active.
Frequently Asked Questions
What does the "bits of entropy" number actually mean?
It's log2(poolSize) multiplied by password length, an estimate of theoretical randomness assuming every character was chosen independently and uniformly at random from whichever character classes your password uses. It measures character-class variety and length, not whether the actual pattern is predictable.
Can a password with high entropy still be weak?
Yes, the entropy formula has no way to detect dictionary words, predictable substitutions, or common patterns. That's exactly why this tool also checks separately for common passwords, sequential runs, and repeated characters, catching predictability the pure math can't see.
Does the common-password check cover every known leaked password?
No, it checks against roughly 30 of the most notoriously overused passwords, a useful illustrative sample rather than a comprehensive breach database. Services like Have I Been Pwned maintain far larger datasets for that purpose.
Does the sequential-pattern check catch keyboard patterns like "qwerty"?
Not directly, it only looks for forward alphabetical or numeric runs like "abc" or "123". Keyboard-adjacency patterns and reversed sequences aren't caught by this specific check, though a pattern like "qwerty" would still be flagged separately by the common-password list.
Will "abab" or "121212" get flagged as a repeated pattern?
No, the repeated-character check only flags a single character appearing three or more times in a direct row, like "aaa". Alternating short patterns are a different, also weak, structure that this specific check doesn't detect.
Is my password ever sent anywhere when I use this checker?
No, the entire analysis, entropy calculation, pattern checks, and common-password matching, runs locally in your browser using JavaScript. Nothing you type is transmitted to a server.