Password Strength Checker

It looks at which character types you used (lowercase, uppercase, digits, symbols) to estimate the pool an attacker would guess from, then computes entropy as length times log2(pool). It also runs pattern checks for common passwords, sequential runs, and repeated characters, and caps the score when it finds one so the rating stays honest.

Entropy in bits measures how many guesses it takes to find your password: each extra bit doubles the work. So a 60-bit password is not slightly harder than a 50-bit one, it is roughly a thousand times harder. That is why the meter rewards length and variety, since both add bits.

It assumes a fast offline attack of about 100 billion guesses per second against a poorly protected hash, and that an attacker finds the password after guessing through half the keyspace on average. That is deliberately pessimistic, so a real attacker facing a properly hashed password would take much longer. Treat it as a worst-case guide, not a promise.

Raw entropy assumes the characters are random, but this tool also checks for real weaknesses. If it spots a common word like "password", a sequence like "1234", or the same character three or more times in a row, it caps the effective strength, because an attacker's dictionary and pattern rules crack those long before brute force does.

Yes. Everything is computed on this page in your browser, with no network request, so the password you type is never sent, logged, or stored anywhere. If you want a safe home for the strong passwords you settle on, Relic keeps everything you copy in an end-to-end encrypted vault that only you can open.