Free tool

Is your password strong?

Type a password and see immediately how long it would hold against a machine trying 100 billion combinations per second. The tool also flags the weaknesses that an entropy calculation cannot see.

Local calculation, nothing sent, nothing stored.

Your password never leaves your browser.

Everything is calculated on your device, in JavaScript. No data is sent to a server, no network is used, nothing is saved or kept. Cut your internet connection: the tool will still work. The field clears automatically when you leave the page.

Password to test

Show the password

Waiting The result appears as you type.

Length: 0 characters
Alphabet used: 0 possible characters
Entropy used: 0 bits
Cracking time: instant

Speed assumption: offline attack at 100 billion attempts per second, on a password stolen from a database. The verdict uses the model most favourable to the attacker, that is, the lowest entropy of the three. The word model assumes a dictionary of 65,536 words, that is, 16 bits per word, and 2 bits per separator. The pattern model assumes a list of 100,000 very common words, plus the cost of the usual transformations: an initial capital, substitution of letters by digits, a year or symbol added at the end.

A password rated strong here may nonetheless have leaked when a website was hacked. The two questions are separate.

What makes a password strong: length before complexity

A password resists an attack when the number of combinations to try is too large for the machine trying them. This number depends on two factors only: the size of the alphabet used and the length. The alphabet is the number of different characters from which each position is drawn: twenty-six if you use only lowercase letters, fifty-two by adding uppercase, sixty-two with digits, about ninety-five counting keyboard symbols.

These two factors do not carry the same weight, and this is the point that almost everyone gets backwards. Adding a symbol raises the alphabet from sixty-two to ninety-five possibilities, a gain of about fifty per cent per character. Adding one more character multiplies the whole set of combinations by the size of the alphabet, a factor of sixty-two. Length acts as an exponent, complexity as a mere multiplication. This is why an eight-character password covering all types remains weaker than a string of sixteen lowercase letters.

We express this resistance in bits of entropy. Each extra bit doubles the attacker's work. Below fifty bits, a stolen password falls within a few hours. Around seventy bits, it holds for several years. Beyond eighty bits, the brute-force attack ceases to be a realistic scenario, and the attacker will look for another door: trapping you with a fake e-mail, or waiting for the service you are registered with to have its database stolen.

The American NIST framework, on which most European security policies are modelled, drew the consequences of this reasoning in its SP 800-63B publication. When the password is the only authentication factor, it must be at least fifteen characters long. The service must also accept at least sixty-four, so as never to prevent a passphrase. These are the only two form constraints that remain.

Why classic corporate rules produce weak passwords

You know the formula: at least eight characters, one uppercase, one digit, one special character, and a mandatory change every three months. This policy was written in the early two thousands and it has produced exactly the opposite of its goal.

The problem is that human beings all solve these constraints the same way. The uppercase goes at the start. The digit and the special character go at the end. The digit is often a year, the current one or a birth year. The special character is an exclamation mark in the vast majority of cases. The result looks like « Printemps2026! »: compliant with the rule, and cracked in a few seconds. Cracking tools have known these habits for a long time and apply them automatically to their word lists. This is what our test reproduces when it flags a common word despite a correct theoretical entropy.

These rules are no longer merely ineffective, they are now discouraged. The NIST writes that a service must impose no composition rule, that is, no requirement to mix uppercase, lowercase, digits and symbols. What it requires instead is to compare each new password against a list of known, common or already compromised passwords, and to reject it if it is there. In other words: form is no longer constrained, substance is checked.

Forced change every three months makes the situation even worse. An employee who has to renew their password four times a year invents nothing: they increment. The password goes from « Soleil1! » to « Soleil2! », then « Soleil3! ». An attacker who has obtained an old version guesses the next in a few tries. This is why current frameworks, in particular those of the American NIST, recommend abandoning periodic expiry and requiring length instead.

The last consequence of these policies is the most visible in offices: the password that has become impossible to memorise ends up on a note stuck under the keyboard, in a notebook, or in a file called « codes.xlsx » sitting on the shared server. A security rule that makes memorisation impossible without offering an alternative shifts the risk, it does not remove it.

The passphrase, explained with examples

The passphrase is the simple answer to this problem. Instead of a short, twisted word, you put together several unrelated words. The length explodes, memorisation becomes easy, and the entropy rises far above what an eight-character word can reach.

Compare. « Tr0ub4dor&3 » has eleven characters and looks strong: it is in fact made of a disguised dictionary word, and substituting letters with digits is among the very first transformations tested. Our tool rates it weak, with about twenty-four bits. Conversely, « girafe agrafe tuile bison » has twenty-five characters, four unrelated words, and is tied to no existing expression. The tool rates it strong, with about seventy bits.

The important point is how these seventy bits are calculated. They do not come from the length in characters, but from the number of words. An attacker targeting a passphrase does not test characters at random: they test combinations of words. Assuming they draw from a dictionary of sixty-five thousand words, each word costs them sixteen bits. Four words are therefore worth sixty-four, five words eighty, six words ninety-six. This is the principle of the Diceware method, where words are rolled with dice from a list of seven thousand seven hundred and seventy-six entries, that is, about thirteen bits per word. Its author now recommends six words, and the Electronic Frontier Foundation says the same.

This is also how serious evaluation libraries reason, such as zxcvbn, developed by Dropbox. They break the input into patterns, calculate the cost of each possible split, and keep the cheapest for the attacker. Our tool applies the same rule: it compares brute force, the word attack and the pattern attack, then displays the least favourable of the three. This is why a four-word phrase comes out strong even though each of its words, taken alone, is worthless.

Three conditions make the difference between a good and a bad passphrase. First, the words must be chosen at random: draw them from a book opened at random, or let your manager generate them. A quotation, a song title or a proverb will not do, because they feature in attackers' lists. Next, you need at least four, and six for critical access such as your e-mail or your password manager. Finally, they must have no logical link between them: « chien chat lapin cheval » forms a category, therefore a much narrower search space.

You can keep the spaces, most services accept them. If one of them refuses them, join the words together or separate them with a hyphen. You then need to memorise only two or three passphrases in total: the one for your computer session, the one for your e-mail, and the one for your password manager. Everything else is handled by the software.

The password manager is the real solution

An SME commonly uses between thirty and eighty online services: e-mail, banking, accounting, invoicing, suppliers, insurers, ordering platforms, social networks. No human brain retains eighty distinct passphrases. Without a tool, only one way out exists, and it is the worst: reusing the same password everywhere. The day one of these services has its database stolen, the attacker automatically tries the username and password pair on hundreds of other sites. This technique has a name, credential stuffing, and it accounts for a significant share of business e-mail compromises.

A password manager solves the problem entirely. It generates a different, long and random password for each service, remembers it, and fills it in for you. You no longer memorise more than a single passphrase, the one that opens the vault. Autofill brings an unexpected and considerable benefit: the manager only offers your credentials on the site they actually correspond to. On an imitation, it offers nothing. It therefore detects the phishing attempts that the human eye lets through.

For a business, prefer a professional version, which lets you share access with a team without passing the password around by e-mail, and revoke it in one click when someone leaves. The cost is generally between three and six francs per person per month. Our cyber check-up tells you where this point sits among your priorities, and the rest of our free tools cover the other aspects.

The limits of this test

This test compares three attack scenarios and keeps the one most favourable to the attacker: brute force character by character, the attack by word combinations, and the attack by a common word paired with a predictable transformation. The assumptions of each are shown below the result, including the dictionary size used. These are estimates, not measurements: a real attacker may have a larger dictionary, or on the contrary may not know your language.

The test measures the resistance of a string of characters, and nothing else. It does not know your life. If you enter your daughter's first name followed by her date of birth, the entropy calculation may rate it acceptable, whereas someone who knows you would guess it in three tries. No automatic tool can detect this kind of weakness.

The list of common words built into this page has a few dozen entries. The dictionaries actually used by attackers contain hundreds of millions, fed by every breach published over the last fifteen years. A password that passes our test may therefore feature in one of these lists. For this specific question, see our dedicated tool: has your password leaked?

Finally, the speed assumption used is that of an offline attack. When the attacker tries directly on a website, the service blocks after a few attempts and the attack becomes impractical, even against a mediocre password. Conversely, if the service stored your passwords without adequate protection, the real speed could exceed our assumption. The figure shown is therefore an order of magnitude meant to compare passwords with one another, not a promise of duration.

Above all, remember this: the strength of a password is necessary, but it is never sufficient. It protects you neither from a fake site that makes you enter it, nor from a theft at the provider. Only two-factor authentication neutralises these two scenarios, and this is why it remains the most cost-effective measure you can put in place this week.

Frequently asked questions

Is my password sent anywhere when I type it?

No, never. The calculation runs entirely in JavaScript on your device. This page contains no form, no network call, no tracker and no storage. You can check this yourself: cut your internet connection and the page will keep working exactly the same.

Why is "Password2024!" rated weak even though it has 13 characters?

Because the theoretical calculation assumes the attacker tries combinations at random. That is not what they do. They start from a list of common words and apply the usual transformations: a capital at the start, a year at the end, an exclamation mark. “Password2024!” is among the first few million guesses of a cracking tool, that is, a matter of seconds. The structure is predictable, so the real entropy is far below the theoretical entropy.

Why is "girafe agrafe tuile bison" rated strong even though it only uses lowercase letters and dictionary words?

Because its strength does not come from the rarity of each word, but from the number of combined words. An attacker targeting a passphrase does not test characters, they test combinations of words. Assuming a dictionary of 65,536 words, each word costs them 16 bits: four words are worth 64, six words are worth 96. This is exactly the reasoning behind the Diceware method. Adding a capital or a digit would change this calculation almost nothing; adding a fifth word would change it a great deal. The NIST has, moreover, removed any requirement to mix character types.

Is it better to have a long password or a complicated one?

Long. Each extra character multiplies the number of combinations to test, whereas adding a symbol only widens the alphabet a little. A twenty-five-character lowercase passphrase is far more resistant than an eight-character word crammed with symbols, and infinitely easier to remember.

Should I change my passwords every three months?

No, this rule has been dropped by current frameworks. The NIST explicitly states that a service must not impose periodic change, and that it should force a change only if there is an indication of compromise. Forced change pushes people to vary a base password in predictable ways, which weakens it. Only change a password if it is suspected of having leaked or of having been seen by someone.

Is a good password enough to protect an account?

No. A perfect password protects you neither from phishing, where you enter it yourself on a fake site, nor from a data breach at the provider. This is why two-factor authentication remains the most cost-effective measure: even stolen, the password is no longer enough to get in.

Can this test tell me whether my password has already leaked?

No, and this is deliberate: checking it would require communication with an external service, which this page forbids itself. This check is possible another way, using methods that never transmit the full password. We cover it in a separate tool.