How strong is your password?

The check runs entirely in your browser using local JavaScript — your password is never transmitted, logged, or stored, and you can verify that in your browser’s Network tab. As a general security habit, though, you should avoid entering a password you actively use into any website. Test a freshly generated password, or change a character or two first.

Strength is estimated from entropy: the number of bits of unpredictability, calculated as length × log2(character pool size), then reduced when common weaknesses are detected (dictionary words, repeats, keyboard sequences, trailing years). More bits means exponentially more guesses to brute-force.

In 2026, ≥80 bits resists offline brute-force from a well-funded attacker, and ≥100 bits is comfortably future-proof. Below ~60 bits is weak for anything valuable. A 16-character random password drawn from all character classes reaches ~105 bits.

Length helps only if the characters are unpredictable. “Password123!” is 12 characters but built from a dictionary word, a sequence, and a trailing symbol — all patterns attackers try first — so its real entropy is far lower than its length suggests.

No. It evaluates strength offline and does not check breach databases (that would require a network request). To make any password unleakable in the first place, generate a unique random one per site and store it in a manager like Apex.