CanDoYa
All tools
Saved toolsYour favorites

Add to favorites

Saved in this browser only.
Private browser utility / Developer

Free Password Strength Meter

English only

Runs entirely in your browser - no upload, no sign-up.

Live workspaceLocal processing

Local analysis

Test a password

Preparing the local estimator…

This is an estimate, not a breach check. Never reuse a real account password just to test it.

Your password stays on this device

Enter a password to see its score, estimated guesses, and practical ways to improve it.

Share this tool
password strength meter / browser utility
01 / Overview

What is a password strength meter?

A password strength meter estimates how many guesses an attacker may need by checking length, common passwords, dictionary words, dates, repeats, keyboard paths, and substitutions. This checker reports a score and attack-time scenarios locally in your browser, so the password is not uploaded for analysis.

02

How to use

  1. 01
    Enter a password

    Type a test password or load the example. The local pattern dictionaries are loaded only for this tool.

  2. 02
    Read the score

    Compare the 0-to-4 strength score, estimated guess count, and slow-hash and fast-hash attack scenarios.

  3. 03
    Follow the feedback

    Replace predictable words, dates, sequences, or repeated patterns. Adding more unrelated words is usually more useful than cosmetic substitutions.

  4. 04
    Use a unique result

    Create and save the final password in a trusted password manager, and never reuse it on another account.

03

Who it's for

  • People reviewing an old password who want to spot common words, dates, repeats, and keyboard patterns before replacing it.
  • Developers testing sign-up UX who need a realistic score and actionable feedback instead of rigid character-class rules.
  • Security trainers comparing short complex-looking passwords with longer, less predictable passphrases.
  • Password manager users checking the guessability of a memorable master-password candidate without sending it to a server.

This meter uses a compact local model inspired by password-cracking strategies. Unlike a simple checklist, it can recognize that a familiar word with a capital letter, number, and symbol may still be easy to guess. It checks a focused list of common passwords and words plus dates, repeats, sequences, keyboard paths, and common substitutions. It cannot protect against phishing, malware, reuse, or a breached service.

Crack time depends heavily on how a site stores passwords. The slow-hash figure assumes 10,000 guesses per second, while the fast-hash figure assumes 10 billion. Treat both as comparisons, not promises. For an account you care about, use a unique password from a password manager and enable multi-factor authentication.

FAQ

Is my password uploaded or saved?

No. The checker and its pattern dictionaries run in your browser, and the password is not sent to CanDoYa for scoring or storage. For extra caution, test a structurally similar example instead of a password currently used on a real account.

Is this password strength meter free?

Yes. You can use it without an account, payment, or usage limit. The estimator loads in the page and performs the analysis locally. No password is required from you beyond the text you choose to enter into the checker.

What is the maximum password length?

The input accepts up to 256 Unicode characters. The cap keeps pattern analysis responsive on phones and older computers. Most services allow far less, so always check the target site's own maximum before generating or changing a password.

How does the password strength checker work?

It starts with the search space implied by length and character sets, then lowers that estimate when the whole password matches likely human choices: common passwords or words, dates, repeated text, sequences, keyboard paths, and predictable substitutions. The resulting guess count maps to a score from 0 to 4.

Does a strong score mean my password has never leaked?

No. Strength scoring and breach checking answer different questions. This meter estimates guessability from patterns; it does not query a breached-password database. A strong-looking password may still be unsafe if it was reused, exposed, phished, or stored insecurely by a service.

Are the crack-time estimates exact?

No. They are rough comparisons based on assumed guessing rates. Real speed depends on the hash algorithm, its work factor, hardware, rate limits, and whether an attacker knows personal details. Use the times to compare candidates, not to predict a guaranteed survival time.

Should every password contain uppercase letters, numbers, and symbols?

Not necessarily. Length, uniqueness, and unpredictability matter more than satisfying a fixed composition checklist. A predictable base word with common substitutions can remain weak. A password manager can create a long random password without relying on a memorable pattern.