Password Strength Checker

Most password meters only count character types, so “Password1!” looks “strong” even though it is cracked in seconds. Fileopia’s checker looks for the patterns real attackers try first – the most common passwords, dictionary words, names, years, keyboard runs like qwerty, sequences, repeated characters and leetspeak swaps – and lowers the score accordingly. It then shows realistic crack-time estimates for an online attack, a slow-hashed leak and a fast-hashed leak, with plain-language tips to fix the weak points.

Common uses

• Check whether an old password is worth keeping or should be changed.
• Teach family members or staff why length beats clever symbols.
• Test the format of a new passphrase before using it for your password manager.
• Audit the strength rules you plan to enforce in an app you are building.
• Compare a random password from a generator with one you invented.

Tips for best results

• Aim for 16+ characters or a passphrase of four or more random words.
• Avoid personal details: names, birthdays, pets, teams and postcodes are guessed early.
• Never reuse a password – one breached site then unlocks all the others.
• Turn on two-factor authentication for email, banking and social accounts.
• Let a password manager generate and remember unique passwords for you.

How the estimate works

The checker starts with the raw search space – the size of the character pool raised to the password’s length – and converts it to bits of entropy. It then subtracts strength for every predictable pattern it finds, because an attacker who tries common words and patterns first will reach your password much sooner than brute force would. The result is a cautious estimate rather than a guarantee: if anything, it errs on the side of calling a password weak.

Three attack scenarios

“Online” assumes someone guessing on a login page that limits attempts to about ten per second. “Slow hash” assumes a stolen database protected with bcrypt or a similar deliberately slow algorithm, at around ten thousand guesses per second. “Fast hash” assumes a leak stored with an outdated algorithm such as MD5 or unsalted SHA-1, attacked with graphics cards at a hundred billion guesses per second. A good password should survive the third scenario for centuries, because you can never be sure how a site stores it.

Passphrases: strong and memorable

Four or five random, unrelated words – like “velvet-orbit-cactus-lantern” – give 50–65 bits of entropy when chosen truly at random, and are far easier to type and remember than “Xk#9!q”. The key word is random: song lyrics, quotes and famous phrases are in attackers’ word lists. Use the password generator on this site with passphrase mode, or roll dice with a word list, and add a separator or digit if a site insists.