Password Strength Checker & Generator
Check password strength and generate strong random passwords offline in your browser.
*Educational @ ~10B guesses/sec. Real attacks also use breach lists and phishing.
Reuse is still a top breach path. Use a password manager and MFA on Microsoft 365, VPN, banking, and admin portals.
Generation prefers crypto.getRandomValues. Scoring never leaves this page.
Does not replace enterprise identity controls, conditional access, or privileged access management.
Free password strength checker and secure password generator
Test a password or generate a new one with this password strength checker and secure password generator. Features include entropy estimates, offline crack-time illustrations, common-pattern flags, random or passphrase modes, multi-password batches, custom exclusions, and ambiguous-character filtering. Everything runs in your browser — secrets are not uploaded to Secure Techies.
How strength is estimated
- Detect character classes (lower, upper, digits, symbols)
- Estimate charset size
- Compute entropy ≈ length × log2(charset) for random-looking secrets
- Apply penalties for repeats, years, Name123 shapes, digits-only, and a small common-password list
- Map entropy bands to Very weak → Excellent
Crack times assume a high offline guess rate for education. Real attackers also use phishing and credential stuffing — unique passwords + MFA beat any single score.
Generator options that matter
- Length 16–20 for important random passwords
- Passphrases of 4–5 words for memorability where allowed
- Exclude ambiguous characters when humans must type secrets
- Generate batches for staged rotations
- Never reuse a generated password across sites
Business password policy baseline
- Password manager for staff
- MFA on Microsoft 365, VPN, finance, and admin
- Block known breached passwords where the IdP allows
- Unique service accounts with vault storage
- Phishing training and reporting
Layer technical controls with cybersecurity services and day-to-day managed help desk. Estimate incident impact with the ransomware cost calculator.
Privacy
Scoring and generation are client-side. Prefer crypto.getRandomValues when available. This is not a replacement for enterprise PAM or conditional access.
Contact Secure Techies for identity hardening and MFA rollout help.
Frequently asked questions
Is my password sent to a server?
No. Strength checks and generation run entirely in your browser with JavaScript. Nothing is uploaded to Secure Techies for this tool.
What makes a password strong?
Length, randomness, and character variety matter most. A long unique passphrase or a high-entropy random password beats short complex patterns that people reuse.
Should I use a password manager?
Yes for almost every business. Managers create unique passwords per site, store them encrypted, and reduce reuse. Pair them with MFA on email, banking, VPN, and admin accounts.
What entropy score is good enough?
As a rough guide, 60+ bits is moderate for many accounts, 80+ bits is strong, and 100+ bits is excellent for high-value vaults. Unique passwords and MFA still matter more than any single number.
Why do crack-time estimates vary?
They are educational estimates based on assumed attack speed. Real attackers also use breached password lists, so a high-entropy unique password is safer than a clever word that appears in dumps.
Want MFA, password managers, and email security done right?
Secure Techies can design, implement, and manage the systems behind these numbers — storage, virtualization, cybersecurity, and recovery.
Talk to an engineer