About Password Strength
Password Strength rates a password and explains the rating in four lines: a strength label, an estimated entropy in bits, the character length, and which character classes it detects. The estimate follows information theory — it measures how large the alphabet is given the classes present (26 lower-case, 26 upper-case, 10 digits, roughly 33 symbols) and multiplies the logarithm of that alphabet by the number of characters.
That makes the number a measure of how hard the password would be to guess if it were random. The model is deliberately generous to length: every extra character raises the entropy linearly, whereas adding a new character class only widens the alphabet. A long passphrase therefore usually scores higher than a short, symbol-heavy string, which is how modern attackers actually operate.
What the model does not do is look at patterns. It has no dictionary of common passwords, no keyboard-walk detection and no leetspeak substitution rules, so something like P@ssw0rd!2024 can score well on entropy while still being trivially guessable. Treat the label as one signal among several, never as a verdict.
How to use Password Strength
- 1 Type the password you want to assess into the field.
- 2 Read the four-line report: strength, entropy in bits, length, and the character sets detected.
- 3 Use the length and character-set lines to see which single change would raise the score the most.
Frequently asked questions
What does the entropy number actually mean?
It is the information content of the password assuming each character is drawn at random from the detected pool. Roughly, 40 bits is weak, 60 moderate, 80 strong, and 128 or more is very strong. It is an upper bound on the guessing difficulty, not an exact attempt count.
Why does a long passphrase beat a short complicated password?
Because entropy grows with length. Four unrelated words offer far more combinations than eight random symbols, and they are easier to remember. This tool reflects that by weighting length through the logarithm of the alphabet.
It rates my password strong, but I know it is common. Why?
The estimate only inspects length and character classes. It has no list of leaked or dictionary passwords, so a well-known pattern that happens to include symbols can still score highly. Never reuse a password that has appeared in a breach, whatever this says.
How does this differ from other strength meters?
Mature meters such as zxcvbn model dictionaries, keyboard patterns and dates. This one is a transparent entropy calculation, which makes it fast and predictable but less nuanced about human-chosen passwords.
Free, online, and private
Free to use
Password Strength is completely free. There is no account to create, no login, and no hidden charge or usage limit.
Runs online in your browser
It is a free online tool that runs entirely in your browser. Nothing to download or install — open the page and start using it right away.
Your data stays private
All processing happens locally on your device. Your input is never uploaded, stored, or tracked, so it never leaves your browser.
How Password Strength behaves in detail
These are the specifics of this implementation — the exact ranges, defaults and fixed settings you are working with.
| Parameter | Value |
|---|---|
| Scoring method | the character total multiplied by log2 of the pool the password draws from |
| Pools counted | 26 lowercase, 26 uppercase, 10 digits and 33 non-alphanumeric, summing to 95 |
| Levels | five — Very weak, Weak, Moderate, Strong and Very strong |
| Very strong gate | 128 bits, or 16 or more characters using at least three classes |
| Strong gate | 80 bits, or 12 or more characters using at least three classes |
| Output rows | the level, the entropy to one decimal, the character total and the classes detected |
| Empty input | short-circuits to the single line Empty password instead of a score |
Compiled from the implementation of this tool and checked against it by itoolnet.
What Password Strength does not do
Knowing the edges of a tool saves more time than another list of its features. These are the cases where it will not do what you might expect.
- The score is arithmetic only — length times log2 of the pool, with no dictionary, no keyboard-pattern test and no repetition check. Sixteen identical a characters scores Moderate at 75.2 bits, while the ten-character Password1! also scores Moderate at 65.7 bits; neither wording nor repetition changes the verdict.
- No list of leaked or common passwords exists anywhere in the implementation and no lookup is performed, so a password that appears in every cracking wordlist is judged purely on its characters. The tool cannot tell you that a password has already been exposed.
- The pool is counted by class rather than by distinct characters: the 33 non-alphanumeric slots are added once whether one symbol is used or thirty, and a space or an emoji is counted inside those same 33.
Tested and documented by itoolnet, the team that builds and maintains this site.