{Formatiq}
Formatiq / Validators / Password Strength Checker

Password Strength Checker

Client-sideNo sign-upFree

Check a password against length and character-variety rules, with a live strength meter.

Password
Strength: Good
Strength meter
Checklist
✓At least 8 characters
○At least 12 characters (recommended)
✓Contains an uppercase letter
✓Contains a lowercase letter
✓Contains a number
✓Contains a symbol
⚠ This only checks pattern strength (length and character variety) - it does not check whether this password has appeared in a known data breach, which would require sending it to a server to check against a breach database. A password can pass every check here and still be compromised if it's been leaked elsewhere. Consider a password manager and a breach-checking service for that separate concern.
In-content slot

About this tool

Type a password to see it checked live against the criteria that actually drive password strength: length (with a bump for 12+ characters), and whether it mixes uppercase, lowercase, numbers, and symbols. Each rule shows as its own checklist item with a checkmark, and an overall Weak/Fair/Good/Strong meter summarizes the result at a glance. A show/hide toggle lets you type it masked by default and reveal it to double-check for typos. This checks pattern strength only - length and character variety - and does not check the password against known data-breach lists, since doing that honestly would require sending the password to a third-party server to compare against a breach database, which a client-side, nothing-leaves-your-browser tool intentionally won’t do. A password can score "Strong" here and still be compromised if it has appeared in a previous breach elsewhere.

Frequently asked questions

No - this only measures pattern strength (length and character variety), not whether the exact password has ever appeared in a known data breach. Checking against breach databases requires sending the password to a server to compare it (as breach-checking services do), which this client-side tool deliberately doesn’t do since nothing you type here is ever transmitted anywhere. A common, previously-leaked password can still score well on pattern strength alone.

Length is the single biggest factor in resisting brute-force guessing, and 8 characters is often a bare legacy minimum many sites still enforce, while 12 or more is closer to what current guidance recommends for real resistance to automated cracking. Splitting them into two checklist items shows you not just whether you cleared the old minimum, but whether you’re meaningfully past it.

The password is only ever processed in your browser’s local JavaScript - it’s never sent to a server, logged, or stored. That said, as a general habit, treat any password-strength tool the way you’d treat any other webpage: reputable ones (this one included) don’t transmit what you type, but there’s no way for a visitor to verify that with certainty just by looking at the page.

Related tools

Email Validator

Check whether an email address is correctly formatted, with a plain-English reason when it isn’t.

URL Validator

Check whether a string is a valid URL and see it broken into protocol, host, path, and more.

Cron Expression Validator

Validate a 5-field cron expression and see its schedule described in plain English.

URL Slug Validator

Check whether a string is a valid, URL-safe slug and get a corrected suggestion if not.

Explore more free tools

Formatters, converters, validators, and generators - all free and running entirely in your browser.

Browse more tools