Password Checker: How secure is your password?

That depends on length, randomness and recognizable patterns. The Password Checker rates your password on a five-level scale from “Very weak” to “Very strong.” For example, passwort123 is “Very weak” and would be cracked immediately if its hash were stolen. Even Sommer1987! remains very weak despite the special character. A random password such as kT9#mQ2$vL8!pX4z is “Very strong.”

The check runs only in your browser: no server requests, no storage, nothing in the URL, and no logging. As long as the password is hidden, detected parts remain masked too. Even so, it’s better to test a similar password rather than your real one.

The Checker estimates how many attempts an attacker would need and divides that by the attack rate: 100 per hour for an online login with lockouts, 10,000 per second for a stolen bcrypt hash, and 10 billion per second for a fast hash such as MD5. Beyond 13.8 billion years, it displays “longer than the age of the universe.” These are estimates, not guarantees.

Entropy in bits applies if every character were chosen at random. Effective strength subtracts the effort an attacker saves because of detected patterns. The gap between the two values shows what those patterns cost you.

Common passwords and words, including capitalization or substitutions like 0 for o, word-like letter sequences, keyboard patterns, sequences like abc or 1234, repetitions, years, and dates. The built-in word list is small and mainly contains English and German entries. It assesses other words by how they sound, so its estimates for them are more optimistic.

The checker recommends at least 14 characters or a passphrase of four or more random words. The passphrase Gartenzaun-Wolkenmeer-Teekanne-Bleistift is “Very strong,” while the short, complex Tr0ub4dor&3 is only “Medium.” For email, password managers, and server access, 16 to 20 characters is a good choice. The time-to-crack table above shows how much each extra character helps.

No. Checking against data breaches would require sending the password or its hash, and this checker doesn't do that. It only assesses strength and patterns directly in your browser.

Follow the displayed tips, such as making your password longer and avoiding words, years, or keyboard patterns. If the result is below “Very strong,” the “Generate Strong Password” button takes you to the password generator to create a new random password.