Password Strength Checker
Type a password to see an entropy estimate, the time it could take to guess at four speeds, and any common patterns that make it weaker.
Ta treść jest po angielsku.
Rozwiązane przykłady
A word, a year and a symbol
Summer2024!
Rating: Fair Length: 11 characters Character types: lower case letters, capital letters, numbers, symbols or spaces Estimated entropy: 22 bits (about 5,563,200 guesses) Length and character mix only: 72 bits, ignoring patterns A site that limits attempts (100 an hour): 6 years A site with no limit (10 a second): 6 days Stolen list, slow hashing (10,000 a second): 9 minutes Stolen list, fast hashing (10 billion a second): less than a second Pattern found: Contains a very common password or phrase (Summer) Pattern found: Contains a year (2024) Suggestion: Make it longer. Twelve characters or more is a good start, and each extra character helps. Suggestion: Avoid common passwords and phrases, even with small changes. Suggestion: Leave out dates and years such as birthdays. Suggestion: Use a different password for every account.
A common word with a year and a symbol is a familiar shape, so it rates lower than its length suggests.
Four unrelated words
correct horse battery staple
Rating: Strong Length: 28 characters Character types: lower case letters, symbols or spaces Estimated entropy: 65 bits (about 4.3 x 10^19 guesses) Length and character mix only: 165 bits, ignoring patterns A site that limits attempts (100 an hour): billions of years or more A site with no limit (10 a second): billions of years or more Stolen list, slow hashing (10,000 a second): millions of years Stolen list, fast hashing (10 billion a second): centuries Pattern found: Contains an ordinary word or name (correct) Pattern found: Contains an ordinary word or name (horse) Pattern found: Contains an ordinary word or name (battery) Pattern found: Contains an ordinary word or name (staple) Suggestion: A single word with a number or symbol added is easy to guess. Join four or more unrelated words instead. Suggestion: Use a different password for every account.
Length and unrelated words give a high estimate, even though every word is ordinary.
A common password
qwerty123
Rating: Very weak Length: 9 characters Character types: lower case letters, numbers Estimated entropy: 6 bits (about 58 guesses) Length and character mix only: 47 bits, ignoring patterns A site that limits attempts (100 an hour): 35 minutes A site with no limit (10 a second): 6 seconds Stolen list, slow hashing (10,000 a second): less than a second Stolen list, fast hashing (10 billion a second): less than a second Pattern found: Contains a very common password or phrase (qwerty123) Suggestion: Make it longer. Twelve characters or more is a good start, and each extra character helps. Suggestion: Avoid common passwords and phrases, even with small changes. Suggestion: Use a different password for every account.
Very common passwords are tried first, so they fall at once.
O narzędziu Password Strength Checker
This password strength checker estimates how hard a password would be to guess. Type one and you get a rating, an entropy estimate in bits, the time it could take to try every likely guess at four different speeds, and a list of the patterns that make it weaker, with suggestions for improving it.
The estimate does more than count characters. It looks for common passwords, ordinary words and names, years and dates, keyboard runs such as qwerty, simple sequences like 1234, repeated characters and the usual letter swaps such as @ for a. Whatever is left over is counted as random characters. The figures are estimates for comparing passwords, and the example passwords on this page are made up for illustration.
Jak korzystać z narzędzia Password Strength Checker
- Type a password in the box. Tick the box to show the characters if you want to check what you typed.
- Read the rating, the time to guess at each speed and any patterns found.
- Follow the suggestions, then try a longer version.
Typowe zastosowania
- Comparing a few ideas for a new password
- Seeing why a clever looking password is easier to guess than it seems
- Teaching staff or family what makes a password weak
- Checking how much a longer password helps
Najczęstsze pytania
What does entropy in bits mean?
Each bit doubles the number of guesses needed. 30 bits is about a billion guesses, 40 bits about a trillion, and every extra bit doubles the effort.
Why is a long phrase rated better than a short mix of symbols?
Length adds guesses much faster than swapping letters for symbols. Four or more unrelated words are hard to guess and easier to remember than random characters.
What do the four speeds mean?
They range from a website that slows down repeated attempts to someone who has a stolen list of stored password codes and tries guesses at very high speed. The slower the hashing used by the site, the more time it buys.
Is a strong rating a promise?
No. It is an estimate based on common patterns and a short word list, so unusual words may be rated more strongly than they deserve. A password that has appeared in a breach is weak however it scores, and each account should have its own.