Password Strength Checker — Test a Passphrase in Your Browser
Most strength meters measure the wrong thing and none of them explain their rules, so a bad password can come back green. This one applies nine visible rules to the characters you typed — which is useful only if you read the score as exactly that.
Last reviewed: Next review due:
Password Strength Checker
Check how secure your password is against common attack patterns. No data is sent anywhere — all checks run in your browser.
Enter a password above to check its strength.
How it works
- It scores out of 7: one point each for reaching 8, 12 and 16 characters, and one point each for containing an uppercase letter, a lowercase letter, a digit and a symbol from a fixed punctuation set.
- It then subtracts 2 if the string is a single repeated character, contains a three-digit run (012 through 890) or contains one of six literal keyboard rows (qwerty, asdfgh, zxcvbn and the full-length rows), and a further 2 if it contains any of sixteen hard-coded words — password, journalist, reporter, newsroom, admin, letmein and similar. The floor is 0.
- The result is banded into four labels: 0-1 Weak, 2-3 Moderate, 4-5 Strong, 6-7 Very Strong, shown as a four-segment bar with the raw score printed underneath.
- It lists all nine criteria with a tick or a cross, and for Weak and Moderate results prints up to three fixed improvement tips.
- Everything is recomputed on each keystroke inside the page. There is no network request, no storage and no logging.
When to use it
- Sanity-checking a passphrase you have just generated before it goes into a password manager.
- Showing a newsroom in one screen why something like “Newsroom2026!” scores Moderate — the common-word penalty catches it.
- Before rotating a shared desk or account password, to check the replacement is not a keyboard walk.
- Teaching the difference between length and complexity in a digital-security session.
What it does not do
- This is a heuristic on the shape of a string. It is not a security assessment, and a high score is not evidence that an account is safe.
- It does not check the password against any breach corpus. A password that appears in a public credential dump can still score Very Strong here, and that single fact matters more than everything the tool does measure.
- The common-word list is sixteen entries long. Real cracking dictionaries run to hundreds of millions of entries, and the tool has no concept of names, dates, football clubs or leetspeak substitution — “P@ssw0rd!” scores Strong.
- The scoring rewards character classes over length, so an NCSC-style three-random-words passphrase cannot reach Very Strong without a capital, digit or symbol bolted on, and the tips actively push you towards symbols. Length is the thing that defeats offline cracking; treat the advice accordingly.
- The checks really do run in the page with no network call, but do not build the habit — test a variant rather than a live password, because most sites offering this feature do transmit it.
More tools
This is one of the free tools on UK JournoHub. See the full tools index for the rest.