OneTaskBy Tim King · Updated
Password Strength Checker
Estimate Entropy and Crack Time, and Spot the Patterns That Weaken a Password
OneTask is free, with no sign-up, and built by one person.
If this tool saved you time, a coffee helps keep new ones coming.
How the Password Strength Checker works
Type a password into this password strength checker and see its estimated entropy, how long it would last against online guessing and offline cracking, and which predictable patterns it contains. The check runs entirely in your browser — nothing you type is sent anywhere.
How the password strength checker scores a password
The starting point is the search space: the password's length multiplied by the log of the number of
symbols it draws from — lowercase, uppercase, digits and punctuation. That gives an upper bound in bits.
Real crackers do not search blindly, so the checker then subtracts heavily for every pattern they try
first: dictionary passwords (with leetspeak such as P@ssw0rd undone), keyboard and alphabet runs, a
character repeated three times, a year, and the Capital-word-digits-symbol shape that most password
rules push people into.
Why three crack times
Online attack assumes a login form that rate-limits to about 100 guesses an hour. Offline fast hash assumes a stolen database hashed with MD5 or SHA-1 and a GPU rig doing ten billion guesses a second. Offline slow hash assumes bcrypt, scrypt or Argon2 at a sensible cost, around ten thousand guesses a second. The same password can be safe in the first case and gone in minutes in the second, which is why how a site stores passwords matters as much as what you pick.
What actually makes a password strong
Length beats complexity. Four or five random words, or sixteen random characters from a password manager, outscore any clever substitution. The only password that is truly strong is one that is random and used nowhere else, because reuse turns one site's breach into access to all of them.
FAQ
Is it safe to type my real password here?
The check runs in JavaScript on this page and the password is never transmitted or stored. Even so, the safest habit is to test a password of the same shape rather than the real one, and to change any password you have pasted into a web page you do not control.
Why does my long password still score as weak?
Length only counts if the characters are unpredictable. A long password built from a dictionary word, a keyboard run and a year collapses to a small search space because crackers try exactly those combinations first, and the checker deducts for each one it finds.
How many bits of entropy is enough?
For an account protected by a slow hash and rate limiting, 60 bits is reasonable. For anything that could be cracked offline against a fast hash, such as an encrypted file or a password vault, aim for 80 bits or more — about 13 random characters or six random words.
Is this the same method as zxcvbn?
It follows the same idea — estimate guesses, then penalise the patterns attackers exploit — but uses a much smaller built-in pattern list so the page stays light. Treat the result as a guide to the order of magnitude rather than a precise figure.
See also: all Security & Identifiers tools, Dev Utilities, Formatters & Validators, Data & Encoding, SEO, Accessibility, AI.
Related tools
Password Generator
Strong random passwords generated in your own browser.
Passphrase Generator
Diceware passphrases from the EFF wordlist, generated locally.
Bcrypt Generator
Generate and verify bcrypt password hashes.
Hash Generator
Generate MD5, SHA-1, SHA-256 and SHA-512 digests from text.
.env File Checker
Lint a .env file for syntax errors, duplicates and weak secrets.