Delimiter.live
Encoding & Security Tools Runs in your browser Free · no account

Password Strength Checker

The password strength checker estimates the entropy of a password and how long it would resist an offline attack at several plausible guessing rates. It also flags common weaknesses such as dictionary words, keyboard runs, repeated characters and dates.

Password to test 0 characters
Strength analysis

Your result will appear here.

Not sure where to start? Use Load example.

Results update automatically and are calculated on your device. Nothing you type is sent to a server.

Runs in your browser. Processing happens entirely in your browser. Nothing you enter is sent to Delimiter.live.

How to use the Password Strength Checker

  1. Type or paste a password — ideally one similar to yours rather than the real one.
  2. Read the entropy estimate and the crack-time projections.
  3. Act on any warnings: dictionary words, keyboard runs and dates weaken a password far more than people expect.

Example

Input
Summer2026!
Output
Entropy: about 36 bits
Offline attack at 10 billion guesses/sec: under a minute
Warning: common word plus a year and a symbol is a well-known pattern

Common use cases

  • Understanding why a password you thought was strong is not.
  • Comparing a passphrase against a shorter random password.
  • Demonstrating password strength concepts in security training.

Limitations and things to watch for

  • The analysis runs entirely in your browser and nothing is transmitted. Even so, the safest habit is to test a password of the same shape rather than one you actually use.
  • Entropy is an estimate based on character set, length and detected patterns. A real attacker uses password lists and rules that no local calculation can fully model, so treat the figure as an upper bound on strength, not a guarantee.
  • Crack times assume an offline attack against a stolen hash. Online guessing against a service with rate limiting is far slower — but you should assume your hash will be stolen eventually.
  • This tool does not check whether a password has appeared in a known breach, because that would require sending data to a third party.

Frequently asked questions

Is my password sent anywhere?
No. The analysis is pure JavaScript running in your browser, with no network request of any kind. The input field is also excluded from autofill and password managers.
What is entropy?
A measure of unpredictability in bits. Each extra bit doubles the number of guesses needed. Below 50 bits is weak against offline attack, 70 or more is comfortable, and 100 or more is excellent.
Why is "Summer2026!" rated weak despite having upper case, digits and a symbol?
Because attackers know that pattern. Cracking tools try dictionary words with a capital first letter, a year and a trailing symbol before anything else, so those additions add almost nothing.
Does it check breach databases?
No. Doing so would mean sending part of your password to a third-party service. Checking your accounts against a reputable breach notification service is worth doing separately.

Share this tool