crackthe.net
Show in English Auf Deutsch anzeigen

Password strength check

How strong is your password? Check it here, right in your browser, against the NIST guidelines. What you type never leaves your device and is never stored.

By Alexander Bock Last updated: July 5, 20262 min read

A good password is the first line of defense for your accounts. Use this tool to see how strong one really is – scored against the recommendations of the National Institute of Standards and Technology (NIST SP 800-63B).

Tip: test a similar example password here – not the real one you use.

No password entered yet.

  • At least 8 characters (better 15+, ideal 20+)
  • Several words, or a mix of characters
  • No keyboard patterns or runs ("1234", "qwerty")
  • No simple repeats ("aaaa")
  • Not a common password or a plain dictionary word

Your password is checked only in your browser and never sent to our server. It is not stored and it does not leave this device. Even so, never type a real password into a site you do not trust.

Reading the result

Modern guidance has moved away from the old advice. Two things decide the outcome:

  • Length. A passphrase of several random words beats a short tangle of symbols, every time. Twenty characters or more puts you in good shape.
  • Not being on a list. A password that already appears in breach data is worthless no matter how clever it looks. Attackers start with those lists.

It turns red as soon as a password contains a keyboard pattern (“qwerty”), a run of digits (“1234”), simple repeats (“aaaa”) or a common word. Those are the first things anyone tries.

Why we do not demand a symbol Older advice insisted on upper case, a digit and a special character. NIST now recommends against those composition rules: they push people toward predictable substitutions like P@ssw0rd! while adding little real strength. Length and uniqueness do the actual work – so that is what this check measures.

The three rules that matter

  1. A separate password for every account. When one service is breached, the rest stay safe.
  2. Length beats complexity. A long passphrase is both safer and easier to remember than P@ss1!.
  3. Let something else remember it. A password manager creates and stores strong passwords for you – and two-factor authentication protects you even when one does end up in the wrong hands.

Want to know whether a password of yours has already turned up in a breach? That is a different check: Check for a data breach .

Frequently asked questions

Is it safe to type my password here?

The check runs entirely in your browser in JavaScript – your password is not sent to our server, not stored, and it does not leave your device. Even so, never type a real password into someone else’s website. Test a similar example instead.

What is it measured against?

The guidance in NIST SP 800-63B. In short: length does the work, and a password must not be one that already appears in breach data. NIST explicitly recommends against forcing a mix of upper case, digits and symbols – so we do not score you on that either.

What do I do if my password is weak?

Use a password manager , which creates and stores a strong unique password for every account. Then turn on two-factor authentication as well.

Topics: Passwords, Checks