How strong is "strong"? Try guessing a password

Every extra bit in a key doubles the number of possibilities. That is why a 256-bit key is not twice as strong as a 128-bit key. It is a number of times stronger that has 38 more zeros on the end.

Why the cipher is rarely the weak spot

Modern ciphers like AES-256 are not broken by guessing. Attackers go after the easier targets: weak passwords, reused passwords, phishing and stolen devices. So the part you control matters most.

Try it

This calculator never asks for a real password. It only uses length and the kinds of characters, then estimates how long an average guess would take under the attacker you pick.

What to take from it

• Length wins. Each extra character multiplies the work. A long phrase beats a short, "clever" password.
• Randomness wins. The estimates assume truly random choices. Words, names and patterns people pick are much easier to guess.
• Uniqueness wins. If one site leaks your password, attackers try it everywhere. A password manager makes unique ones painless.
• A second step wins. Two-factor sign-in stops most stolen-password attacks.