I built this after noticing how many 'strong' passwords are actually weak — 12 characters of dictionary words crack in seconds. This tool checks the factors that actually matter: length, character diversity, repeated patterns, and known weak structures. Everything runs in your browser.
Very weak — 10/100
Your files are processed in your browser and never uploaded to any server.
The biggest surprise for most people: `P@ssw0rd123!` scores worse than a 20-character passphrase like `correct-horse-battery-staple`. Length beats complexity. My advice: aim for 16+ characters, mix in a few numbers and symbols, and avoid anything based on a dictionary word or your personal info. Also — never test your actual production passwords on any online tool. Use a similar-length throwaway to see the pattern.
— Mirza Noman Baig
These are actual measurements from using this tool, not estimates.
Before
Password met the 12-character policy but scored 'Fair'
After
Changed to a 20-character passphrase, scored 'Excellent'
Met the policy on length alone. The policy didn't catch that it was based on a dictionary word.
Before
Thought it was strong because it had symbols
After
Score dropped when pattern check flagged it
Repeated 'abc' pattern in the middle. Score was 'Fair', not 'Excellent' as expected.
Before
Wanted to verify the generator wasn't producing weak output
After
Every generated password scored 'Excellent'
Confirmed the generator was doing its job correctly.
Checks length, character diversity, patterns, and common weaknesses.
Weak, Fair, Good, Strong, or Excellent — with specific reasons.
See exactly what your password passes and what it fails.
Your password never leaves your browser. No logs, no storage.
No. Everything runs in your browser. Your password never leaves your device.
Ideally, no. Even though it stays in your browser, avoid typing real production passwords into any online tool. Test a similar pattern with a throwaway instead.
Length first — 16+ characters. Then diversity — mix of cases, numbers, symbols. Avoid dictionary words, personal info, and repeated patterns.
No. It means the password follows good practices. If it's already been leaked in a breach, no score can help — you'd need to check a breach database separately.
Length matters more than complexity. A 20-character password has vastly more possible combinations, making brute-force attacks impractical.
