Password Security Tool

A password security checker takes a candidate password and scores it against the metrics modern attackers actually use: length, character-set diversity, presence in published breach corpora, and similarity to common dictionary patterns. The score is not just about how long the password is. A 12-character password that consists of a real word followed by a year is weaker than an 11-character passphrase made of unrelated dictionary words, because the word-plus-year pattern is what crackers throw at the hash first.

NCSC password guidance has shifted over the last decade. The current recommendation (NCSC password administration guidance, 2024 update) is to drop forced periodic rotation, drop complexity rules that require a special character, and instead push for length, uniqueness per service, and breach-checking on selection. Multi-factor authentication on every account that supports it is the bigger lever. Password strength is the second lever.

The password checker is the right place to test a candidate password before you set it. It is the wrong place to test passwords already in use, because typing them into any tool (including this one) widens the surface where they have been seen. We do not store the passwords you check, but the right operational discipline is to use a password manager that scores strength internally as you generate.