Password strength.

How to test a password

1. Type or paste a password into the box. The result updates as you type.
2. Read the strength score, the estimated time to crack and any warnings about common passwords.
3. If you need a new one, set the length and character set and press Generate.

What makes a password strong

Length matters more than cleverness. Every additional character multiplies the number of guesses an attacker needs, while swapping an a for an @ barely helps, because cracking tools try those substitutions first. A long random string, or a passphrase of several unrelated words, beats a short password full of symbols. Avoid names, dates, keyboard patterns and anything that appears in lists of leaked passwords, which are tried before anything else.

The time-to-crack figure is an estimate that assumes an offline attack against a stolen database at a given guessing speed. Real-world risk depends on how the site stores passwords, whether it limits attempts and whether you reuse the password elsewhere. Use a unique password for every account and a password manager to remember them.

Your password never leaves this page

The checker runs in your browser, inside an isolated frame on this page that has no network access. Your file is read and written back by your own device, so it is not uploaded to TNAADO or anyone else, and nothing is stored. The advertising on this page sits outside the frame and cannot see what you choose. Nothing you type is sent over the network, so you can test real passwords safely. Even so, avoid testing the exact password of an important account on any website; try something similar in structure instead.

• Aim for at least 14 random characters, or five or more random words.
• Turn on two-factor authentication for important accounts.

Common questions

Is a long password with only letters strong enough?

Length counts for a lot. A random string of sixteen letters is far harder to guess than a short mix of letters, digits and symbols, though adding symbols and digits increases the pool each character is drawn from. The generator offers all three character sets so you can match a site\'s rules.

Why does the tool flag common passwords?

Attackers try the most popular passwords, and variations of them, before anything else. A password that appears in leaked lists can be broken instantly however long it looks, which is why the checker compares what you type with a list of common choices.