Password strength checker
Assess your password’s length and predictability and see what to improve. The check runs in your browser without sending the password to a server.
Evaluated on this page. The checker does not send or save your password.
Enter a password to see an estimate.
What a password strength checker can tell you
A password checker estimates how hard a password may be to guess. Kryon checks length, the character sets used, a small list of common passwords, repeated characters and alphabet, number or keyboard sequences. It updates the result as you type, without submitting the password.
For account protection, use a different password for each service, save it in a password manager and enable two-factor authentication.
How to check your password strength
Enter a password, review the suggestions and check your updated version.
Enter a password
The field is hidden by default. Use the eye button only when nobody else can see your screen. No account, sign-in or submission is required.
Review the weak points
Look for short length, repeated characters, common passwords and sequences. A familiar word with a year or an exclamation mark may remain predictable even if it looks complex.
Replace it with a unique password
Generate a fresh random password for that account, save it in a password manager and enable multi-factor authentication. Do not reuse the example passwords shown in any guide.
What makes a password strong?
Length, unpredictability and using a different password for every account matter more than satisfying a checklist of symbols.
Choose enough length
For a new random password, start with 16 or more characters if the service allows it. Increasing the length gives an attacker more combinations to try.
Make it hard to predict
Random generation avoids the names, dates and patterns people often choose. Replacing a with @ or adding 123 does not reliably fix a familiar word. A passphrase should use independently chosen random words, not a quotation.
Use it for one account
Even a complex password becomes risky when reused. If one service leaks credentials, attackers can try them on your email, banking and other accounts. A strength score cannot detect reuse.
Protect the account as well
Store passwords in a trusted manager and enable MFA. Consider a passkey where supported: it can resist phishing that captures a typed password. Protect your recovery methods too.
Manage your passwords with Kryon Pass
Explore our password manager for generating passwords, storing important information and filling in logins.
Threats a high score does not prevent
A useful password check also explains its limits. These attacks need protection beyond changing characters.
Dictionary and targeted guessing
Attackers try common words, personal information and predictable substitutions before exhaustive search. Our small pattern list cannot identify every language, name or personal detail.
Credential stuffing
A stolen email-and-password pair can be tried on other services. A new unique password for each account limits that chain reaction. Replace exposed credentials even if the checker rates them highly.
Phishing and fake sign-in pages
A convincing website can steal a strong password as you type it. Check the domain, use your manager’s domain matching and prefer phishing-resistant passkeys or security keys when available.
A stolen password database
Attackers can guess against stolen hashes without a website’s sign-in limits. Long random passwords help, while the service’s password storage also matters. No online calculator can promise an exact time to crack.
How the strength and crack-time estimates work
The checker considers length, character types, repetitions, sequences and a list of common passwords. Predictable patterns it recognises reduce the score.
Time estimates use fixed example speeds. A website may limit sign-in attempts; guessing against a stolen database depends on its password protection and the attacker’s hardware.
Password strength questions
How the estimate is made and what to do with it.
No. The check runs in your browser without sending the password to a server or saving it. Close the page when you have finished on a shared device.