Learn More About Password Security
Test how strong your password is in real time. The visualizer below scores your password against six security criteria and tells you exactly what to add to make it stronger. Nothing is sent to a server — every check runs in your browser.
How the Visualizer Scores Your Password
Your password is graded on six checks. Each check it passes adds to the score and pushes the strength meter further to the right.
- Length — at least 12 characters. Length beats complexity. A 16-character passphrase is stronger than a scrambled 8-character one.
- Uppercase letters — at least one (A–Z).
- Lowercase letters — at least one (a–z).
- Numbers — at least one digit (0–9).
- Special characters — at least one symbol such as
!@#$%^&*. - Common pattern check — flags the obvious ones (password, 123456, qwerty, your name, sequential keys).
What the Strength Tiers Mean
| Tier | Score | Estimated time to crack |
|---|---|---|
| Very Weak | 0–1 / 6 | Instant |
| Weak | 2 / 6 | Minutes to hours |
| Fair | 3 / 6 | Days to weeks |
| Strong | 4–5 / 6 | Years |
| Very Strong | 6 / 6 | Centuries (offline brute force) |
Password Best Practice in 2026
- Use a passphrase, not a password. Four random words (correct horse battery staple) beat P@ssw0rd! every time.
- Never reuse a password. One leaked password becomes a master key to every account that shares it.
- Use a password manager. Bitwarden, 1Password, KeePassXC, or Apple/Google’s built-in managers generate and store unique strings for every login.
- Turn on two-factor authentication. Even a perfect password can be phished. A second factor stops the attacker.
- Stop “compliant” rotation. NIST SP 800-63B dropped the every-90-days rule in 2017 — only change a password when there is reason to suspect compromise.
Frequently Asked Questions
Is it safe to type my real password into this tool?
Technically yes — nothing leaves the browser. As a habit, do not type a real password into any third-party form. Use a near-equivalent (same length, same character mix) to test strength.
Why does length matter more than complexity?
Each extra character multiplies the search space exponentially. A random 8-character mixed-case alphanumeric password has ~218 trillion combinations; a random 16-character one has ~47 octillion. Complexity adds a constant factor; length adds an exponent.
What is the strongest type of password?
A randomly generated string of at least 16 characters that mixes upper, lower, digits, and symbols — generated by a password manager. If you must memorise it, use a 5–6 word random passphrase.
How often should I change my password?
Only when you have reason to think it’s been exposed (data breach notice, suspicious account activity). Forced rotation makes people pick weaker, predictable variants.
Are biometrics safer than passwords?
Biometrics are convenient but not a replacement — they unlock a stored credential on the device. The underlying password or passkey still needs to be strong.
What is a passkey and should I use one?
A passkey is a cryptographic credential tied to your device (phone, laptop) that replaces the password entirely. It cannot be phished or reused. Where a service offers passkeys (Google, Apple, Microsoft, GitHub, PayPal, Amazon), enable them.
How do I check if my password has been leaked?
Use Have I Been Pwned. It uses a k-anonymity API so your password’s full hash never leaves your browser.
Why does the meter flag “Password1!” as weak?
Because it’s in every cracker’s dictionary. Attackers start with leaked-password lists, then add common substitutions (a→@, o→0, append “1!”). Anything based on a dictionary word fails fast.