Short answer: type a password below to see roughly how long it would take an attacker to guess it, and why. The check runs entirely in your browser. Nothing you type is sent to CyberExperts or anyone else, stored, or logged.
Results appear as you type.
Privacy: this tool has no network code. It does not send, save or log what you type, and it keeps working if you disconnect from the internet after the page loads. Even so, it is good practice not to type a password you use today into any website; test a similar one instead.
How the checker works
- It starts with length and character variety. Each extra character multiplies the number of guesses an attacker needs. Length helps far more than swapping in a symbol.
- Then it looks for shortcuts attackers use. Common passwords, dictionary words with @ for a or 0 for o, keyboard runs like qwerty, repeated characters, sequences like 123, and years. Cracking tools try all of these before random guesses, so each one lowers the score.
- It shows three attack scenarios. A website that limits login attempts, a stolen database protected with a slow hash like bcrypt, and a stolen database with a fast, unsalted hash. The same password can be fine in the first case and weak in the third.
- It is an estimate. Real attackers use huge breach lists and smarter rules than any short script. Treat "Strong" as "not an obvious target," not a guarantee.
What makes a strong password in 2026
The current US government guidance, NIST SP 800-63B (Revision 4, August 2025), changed a lot of old advice. Sites following it should:
- Require at least 15 characters when a password is the only factor, and at least 8 when it is used with multi-factor authentication.
- Allow at least 64 characters, spaces, and all printable characters, so long passphrases work.
- Not force mixtures of uppercase, numbers and symbols, and not force periodic password changes. A change is required only when there is evidence the password was compromised.
- Check new passwords against a blocklist of common, expected or breached passwords.
- Allow password managers, autofill and paste.
For you, that means: use a long passphrase or a random password from a password manager, never reuse it across sites, and turn on multi-factor authentication wherever you can. NIST also notes that passwords are not phishing-resistant, which is why passkeys and security keys are worth turning on for your email and bank. If you set the rules for a company, our password policy best practices guide turns this into a policy you can adopt.
If your password was in a breach
Change it on that site and anywhere else you used it, starting with email, because email resets everything else. Then turn on MFA. Our explainer on what to do after a data breach covers the rest.
Studying for a certification? Password management, hashing and authentication show up in the Security+ and GIAC GSEC objectives. For more free utilities, see our certification cost calculator, patch priority checklist, CVSS calculator, phishing quiz, cert readiness quiz and list of cybersecurity tools.
Free one-page Cert Exam Checklist (PDF). What to do six weeks out, two weeks out and on exam day. Join the CyberExperts Daily Brief and the download link appears here.
Weekday mornings, five minutes. Unsubscribe any time. You'll get a confirmation email first.You're on the list. Here's your checklist.
Download the Cert Exam Checklist (PDF)Password strength FAQ
Is it safe to type my password into this checker?
The checker runs only in your browser and has no code that sends what you type anywhere. You can load the page, disconnect from the internet, and it still works. As a habit, test a password similar to your real one rather than the real one.
How long should a password be?
At least 15 characters if the password alone protects the account, per NIST SP 800-63B Revision 4. Sites may allow 8 characters when the password is paired with multi-factor authentication, but longer is still better.
Do I need symbols and numbers in my password?
Not if it is long. NIST now tells sites not to require mixes of character types, because people respond with predictable swaps like P@ssw0rd1. A long passphrase of unrelated words beats a short password full of symbols.
Should I change my password every 90 days?
No. NIST says sites should not force periodic changes. Change a password when you have a reason, such as a breach notice, a phishing scare or reuse on another site.
What are password policy best practices for a company?
Set a 15-character minimum for single-factor logins, allow long passphrases and password managers, block common and breached passwords, drop forced rotation and composition rules, rate-limit failed logins, and require MFA, ideally phishing-resistant. Our password policy best practices guide covers each step.
Sources: NIST, SP 800-63B Revision 4, Digital Identity Guidelines: Authentication and Authenticator Management (August 2025), section 3.1.1, accessed October 24, 2026.