Password Strength Checker

Is your password really strong?

Plenty of people think Liverpool2025 is a good password: thirteen characters, a capital letter, some digits. Jood's password strength checker still rates it "Very weak" and estimates it would be guessed in less than a second, because a well-known word followed by a year is one of the first things an attacker tries. The tool does not just count characters, it looks for the patterns that make a password easy to guess.

How to use it

1. In the "Password to Test" box, type a password with the same shape and length as yours, not the real one.
2. Click "Start Now".
3. Read the result: a strength rating on five levels, a score out of 100, the character count, an estimate in bits, the estimated time to guess, and tips for your password.

What the tool picks up

• Common passwords such as 123456, qwerty, password or very common first names, even with digits or symbols added at the end, or written as p@ssw0rd.
• Sequences like abc or 1234, and keyboard rows like qwerty or azerty.
• Repetition such as aaaa or abcabc.
• A year at the end, like 1990 or 2024.

Phrases made of several words are rated realistically, since written language is more predictable than random letters. Even so, the classic "correct horse battery staple" comes out as "Strong".

How to read the time to guess

The time shown assumes a fast offline attack: someone has stolen a database of password hashes and tries ten billion guesses per second. That is the worst case, and it is what happens in big data breaches. That is why 8 random characters only get "Moderate" and fall within days, while 16 random characters would take billions of years.

What no checker can know

• The tool does not know your life: your child's name, your favorite team and the year it was founded, your birthday. A password built on those can look strong here and still be easy for someone who knows you.
• A strong password used on several sites becomes weak the moment it leaks from one of them.
• The password is sent to Jood's server for analysis and not stored, but the safest habit is still to test a similar password rather than the real one.

If the result is weak, make a new one with the strong password generator and keep it in a password manager. To hash a piece of text, use the MD5 and SHA hash generator.

FAQ