Password Strength Checker
See how strong a password really is, its entropy in bits, and roughly how long it would take to crack. All in your browser, nothing transmitted.
How the strength score works
There is no magic here, just math you can check. The tool looks at which character types you used (lowercase, uppercase, digits, symbols) to estimate the size of the pool an attacker would have to guess from, then computes entropy as length * log2(pool). More length and more variety mean more bits, and each extra bit doubles the work. The crack-time estimate assumes a fast offline attack of about 100 billion guesses per second against a poorly protected hash, which is deliberately pessimistic. It runs entirely in your browser, so the password you type is never sent across the network.
A strong password still needs a safe home
The catch with a genuinely strong password is that it is impossible to remember, so it ends up in a sticky note, a chat to yourself, or a plain text file. Relic is the end-to-end encrypted memory for everything you copy, masked by default and readable only by you, so the long random strings you generate stay both safe and one search away. Test a password here for free, then keep it somewhere only you can open.
Frequently asked questions
How does this password strength checker work?
It looks at which character types you used (lowercase, uppercase, digits, symbols) to estimate the pool an attacker would guess from, then computes entropy as length times log2(pool). It also runs pattern checks for common passwords, sequential runs, and repeated characters, and caps the score when it finds one so the rating stays honest.
What does entropy in bits actually mean?
Entropy in bits measures how many guesses it takes to find your password: each extra bit doubles the work. So a 60-bit password is not slightly harder than a 50-bit one, it is roughly a thousand times harder. That is why the meter rewards length and variety, since both add bits.
How is the crack-time estimate calculated?
It assumes a fast offline attack of about 100 billion guesses per second against a poorly protected hash, and that an attacker finds the password after guessing through half the keyspace on average. That is deliberately pessimistic, so a real attacker facing a properly hashed password would take much longer. Treat it as a worst-case guide, not a promise.
Why is my long password still rated weak?
Raw entropy assumes the characters are random, but this tool also checks for real weaknesses. If it spots a common word like "password", a sequence like "1234", or the same character three or more times in a row, it caps the effective strength, because an attacker's dictionary and pattern rules crack those long before brute force does.
Is it safe to type my real password here?
Yes. Everything is computed on this page in your browser, with no network request, so the password you type is never sent, logged, or stored anywhere. If you want a safe home for the strong passwords you settle on, Relic keeps everything you copy in an end-to-end encrypted vault that only you can open.