Password strength tester

How it works

You type or paste a candidate. The tester checks obvious traits: how long it is, which character classes appear, whether it is a single dictionary word, whether it is a keyboard run, whether it repeats. Some testers also compare against lists of passwords that already leaked. The screen then shows a meter, a label, or a short list of problems.

The meter is a heuristic. It is not a measurement of your account’s actual attackers. It cannot see whether you reused the password, whether the site stores it well, or whether phishing will steal it tomorrow. A password tester that never leaves your browser is still only reading the string you gave it.

Treat warnings as a punch list. If it says the candidate is a word plus a year-shaped suffix, believe the pattern match, not the color of the bar. If it says “add a symbol” while the password is already a long phrase, the rule may be crude. Length and uniqueness do more than a single punctuation sprinkle. The tester may not be wise. It is still useful when it catches a tiny, reused, or obvious string before you save it.

Run the tester on a candidate you have not used anywhere else. Prefer a long passphrase over a short puzzle of substitutions. Never paste a live production password into a page you do not trust. Let a password manager store the result; do not keep it in a chat log.

What the score can and cannot see

Local checks see the string. They can flag “password”, repeats, and short length. They cannot flag that the string is also your email. Remote checks against leak lists can flag that the string has shown up in a dump, which is a reason to abandon it. They require you to send the string or a hash of it to someone else. Know which kind you are using.

Composition rules on websites are not the same as strength. A site may demand a symbol and cap length. A tester may praise a long phrase the site will reject. Satisfy the site’s rules, then still avoid reuse. The password strength tester is a second opinion, not the login form.

A meter that turns green is not a promise. It is a guess about the next attacker, not yours.

Using a tester without lying to yourself

If you need a password for a real account, generate it in a manager, then optionally run a tester on a dummy with the same shape if you are evaluating the tool. Do not type the live secret into random websites to see a color. For evaluating your own policy, test examples you created for that purpose: short, long, phrase-like, and patterned. Read which examples fail. Change the policy if the tester and the form disagree in a way that pushes people toward short complex strings.

Reused passwords fail in the world even when a meter is happy. The tester will not know about reuse unless you tell it every site, which you will not. Unique and long beats clever and shared. If the password tester encourages a dance of one capital and one digit, ignore the dance and lengthen the phrase.

Decide whether the tool runs only in the browser. Feed it samples, not the keys to a live inbox, unless you trust the page the way you trust the manager. Fix the first real issue it names, then stop decorating the string.