Password strength checker
Type a password to see entropy + time-to-crack against three attacker speeds. The value never leaves the browser — all computation is client-side.
Enter a password
Computation is 100% client-side. The value never leaves the browser; no network request is made on input.
Tips: length beats complexity. A 16-character lowercase passphrase has more entropy than an 8-character Tr0ub4dor pattern. NIST 800-63B recommends a 12+ character minimum without composition rules; pair with a password manager + MFA.
Keep hardening your site
This is one check of many. Run the rest — every tool is free, no account.
Security headers scan
Grade your live response headers
TLS certificate scan
Grade chain, expiry, and key strength
Security headers builder
Emit a ready-to-paste header block
CSP analyzer
Grade your Content-Security-Policy
Cookie security audit
Check Secure, HttpOnly, SameSite
Mixed-content scanner
Find http:// assets on https pages
Open-redirect detector
Probe redirect params for abuse
HSTS preload checker
Grade against Chrome's preload list