Password Strength Analyzer
Score a password's strength (Weak/Fair/Good/Strong) and get specific, actionable feedback — length, character variety, common-password matches, repeated/sequential characters, and keyboard-walk patterns like "qwerty". Runs entirely in your browser; the password is never sent anywhere.
Input
Your password never leaves your browser — all analysis happens locally.
Output
| Metric | Value |
|---|---|
| No data yet | |
| Feedback |
|---|
| No data yet |
Guides
What does this tool do?
Type or paste a password and get an instant strength score — Weak, Fair, Good, or Strong — along with a plain-English list of exactly what's holding it back. Rather than just showing a colored bar, this tool checks the specific things that make passwords crackable: insufficient length, missing character variety, matches against known common passwords, repeated characters, sequential runs like "abcd" or "1234", and keyboard-walk patterns like "qwerty" or "asdf".
How the score works
The analyzer builds a 0–7 point score and converts it to a 0–100 scale:
- Length points (0–3): fewer than 8 characters scores 0; 8–11 scores 1; 12–15 scores 2; 16 or more scores 3.
- Variety points (0–4): one point each for containing lowercase letters, uppercase letters, digits, and symbols.
- Pattern penalties (−2 each): repeated characters (
aaa,111), sequential runs (abcd,4321), and keyboard-walk substrings (qwerty,1234) each subtract two points — and can stack if a password has more than one. - Common-password override: if the password is an exact, case-insensitive match against a curated list of the most-breached passwords (
password,123456,qwerty, and similar), the score is forced to 0 regardless of length or variety — a long password that's still a well-known password is not a strong password.
The final point total maps to a label: 0–1 is Weak, 2–3 is Fair, 4–5 is Good, and 6–7 is Strong. The tool also reports the password's entropy in bits — a rough measure of the search space an attacker would need to brute-force, based on character-pool size and length — alongside the raw length and which character types are present.
How to use it
- Type or paste a password into the field. The Password field is masked like a normal password input, and results update as you type.
- Read the Summary table for the strength label, numeric score, entropy, length, and character types used.
- Read the Feedback table for specific, actionable suggestions — add a missing character type, lengthen the password, avoid a detected pattern, or move away from a common password entirely.
- Copy or download the feedback list if you're documenting a password policy review.
FAQ
Does a high score mean a password is uncrackable? No — it means the password avoids the specific weaknesses this tool checks for. A truly random, sufficiently long password with full character variety is very hard to brute-force, but no automated score can catch every risk (e.g. reuse across sites, or being tied to publicly known personal information).
Why did a long password still score "Weak"?
Length alone isn't enough. If the password is an exact match for a known common password (even a long one like password123), or it's dominated by a repeated/sequential/keyboard-walk pattern, the score reflects that it's easy to guess despite its length.
What counts as a "symbol"? Anything that isn't an uppercase letter, lowercase letter, or digit — punctuation, spaces, and other characters all count.
Is the common-password list exhaustive? No. It's a short, hand-curated list of the most notorious, frequently reused passwords — enough to catch the obvious cases, not a full breach-corpus dictionary. A password not on the list can still be weak for other reasons the feedback highlights.
Privacy
All analysis happens entirely in your browser using JavaScript — your password is never transmitted, logged, or stored anywhere, including to iotools.cloud's own servers.