Free Password Strength Checker & Generator

Weak passwords remain the single most common entry point for WordPress site compromises. The Australian Cyber Security Centre (ACSC) reports credential theft is behind the majority of cyber incidents each year — and most could be prevented with a stronger password.

This tool tests any password against real-world attack metrics: entropy in bits, character set size, and estimated crack time assuming a fast offline GPU attack at 10 billion guesses per second. You can also generate a cryptographically secure password using your browser’s built-in random number generator — no data is sent to our servers.

How password strength is actually measured

Most password meters grade passwords on surface-level rules — length, uppercase, numbers. Our tool uses entropy — a mathematical measure of password randomness and unpredictability.

Entropy is calculated as: bits = log₂(charset_size ^ length)

A password drawn from 94 printable characters at 12 characters long has roughly 79 bits of entropy. A fast GPU cluster running offline against a leaked hash (a scrambled password stored as a string of random characters) can test around 10 billion passwords per second — meaning at 79 bits, brute-force would take millions of years. At 40 bits (a weak 8-character password), that same cluster cracks it in under a minute.

What makes a password strong?

Three factors determine password strength:

Length — The most powerful factor. Each additional character multiplies the keyspace (the complete set of all possible, unique passwords) exponentially. Going from 8 to 12 characters with the same charset is roughly 100,000× harder to crack, not 50% harder.

Character set size — Using uppercase, lowercase, numbers, and symbols expands the charset from ~52 to ~94 characters, meaningfully increasing entropy per character. But length still beats complexity: correct-horse-battery is stronger than P@55w0rd.

Unpredictability — A password like Password1! scores well on surface rules but is in every attacker’s dictionary. True randomness matters — which is why this generator uses crypto.getRandomValues(), the same cryptographic RNG used in banking applications.

Why “exclude ambiguous characters” matters

Characters like 0, O, l, 1, I cause transcription errors when passwords are read aloud or entered by hand. If you ever need to type your password from a printout or read it to a colleague, enabling this option removes those characters without meaningfully reducing entropy.

Crack time explained

The crack time shown assumes an offline attack — an attacker who has stolen a password hash from a database breach and is running it against a GPU farm on their own hardware. This is the realistic threat model for credential stuffing attacks.

Online attacks (guessing against a live login form) are orders of magnitude slower due to rate limiting and lockouts. But offline cracks are why password reuse is so dangerous — one breached site hands attackers a hash they can crack at full speed.

Should I use a password manager?

Yes — always. The best password is one you never have to remember because a password manager handles it. Tools like Bitwarden (open source, free) or 1Password generate and store unique passwords for every site. The generator above can create passwords to import directly into any password manager.