Password Structure Check
The Password Structure Check assesses the length, character variety and predictable patterns of a password. The tool runs entirely in your browser; the password you type is never sent anywhere.
Recipes for a “strong password” usually stay abstract: add a capital letter, use a digit. This tool makes the recipe concrete and assesses the structural features of a password the moment you type it. The most important point should be clear from the start: this tool runs entirely in your browser, the password is never sent anywhere, never stored, and no trace remains once you close the page. Even so, if you prefer, you can get a sense of the result by typing a test password with the same structure rather than your real one.
Tool
Frequently asked questions
Is my password really not sent anywhere?
Yes; the whole assessment is carried out by code running in your browser, on your own device. What you type does not go onto the network, never reaches a server and is not stored. If you are still uneasy, you can type an example with a similar structure instead of your real password; the result is just as instructive.
A long but simple password, or a short but complex one?
The current approach puts length first: a long password made of four random words is generally more resistant than a complex one of 8 characters, and it is easier to keep in mind. The best course is to combine the two and leave the job to a password manager.
Is it safe to use a password manager?
A reputable password manager is clearly safer than repeating the same password everywhere, because it makes generating a unique, long password for every account practical. Choosing a strong master password and protecting it with two-step verification completes the arrangement.
How often should I change my password?
Current security thinking recommends change when it is needed rather than change on a schedule: if you suspect a breach, have shared a password or have a weak structure, change it at once. Frequent change without reason can push people towards weak, predictable variations.
Method and formula
The assessment works along three axes, all computed inside your browser. The first is length: today the number of characters is the most decisive factor in password strength. The current approach in NIST SP 800-63B recommends a floor of at least 15 characters for single-factor use and at least 8 characters where multi-factor authentication forms part of the picture; a compulsory mix of character types is not treated as a measure of strength. The second is variety: using lower and upper case, digits and symbols together enlarges the number of possible combinations. The third is predictable patterns: repeated characters (aaa), consecutive numbers and keyboard runs (123456, qwerty), common words and year-like numbers are all looked for, and each pattern found lowers the assessment. The result is a structural assessment formed from the combination of these axes.
How to read the result
A high score does not mean “this password can never be broken”; it shows that the password is long enough and structurally free of weak patterns. A low score is not cause for panic but an invitation to change. Just as important as structure is the way a password is used: even the strongest one puts every account at risk if it is repeated across several of them. A separate password for each account, kept in a password manager, offers more protection than structural strength alone.
Limits
- The tool does not check whether your password has appeared in a past data breach; it only assesses structure.
- It may not detect passwords derived from your personal details, such as a date of birth or a child’s name, because it does not know your context.
- The assessment relies on lists of common patterns; a pattern that is not on the list can be missed.
- The score measures the structure of the password, not the security of the account; layers such as two-step verification are separate and important.
Calculator and tool methodology · Nothing you type is sent to a server; results stay in your browser.