How to estimate password strength locally
Length and character-set checks in the browser — a heuristic, not a breach database, and not a substitute for a password manager.
What the score measures
Password Strength Checker at /tools/password-strength scores length (8+, then 12+), mixed case, digits, and symbols. Labels run from Very weak through Very strong. Feedback tells you which check failed. The score does not look up Have I Been Pwned, does not detect “Password1!”, and does not know your company policy. A high score can still be a reused phrase. Generate a new secret on Password Generator at /tools/password-generator instead of polishing a memorable one.
Steps
1) Open Password Strength Checker. 2) Type or paste the candidate — the result updates as you type on the article page. 3) Read the label and the feedback list. 4) If you are choosing a new password, switch to Password Generator, enable several character sets, use length 16 or more, then copy into a manager. 5) Close the tab so the secret is not sitting in memory on a shared PC.
Strength vs hashing
A strong password is still stored as a hash on a well-run server. Bcrypt Hash / Verify at /tools/bcrypt-hash is for hashing and checking a bcrypt string locally, not for scoring human-memorable phrases. Hash Generator is a SHA digest of any text and is not a password store. HMAC needs a key. None of these replace a manager’s generator.
Worked example
“hello” is very weak (short, no mix). “HelloWorld2026” improves length and case and digits but may still be guessable. A 20-character random mix from the generator should land on Strong or Very strong on this heuristic. If your workplace forbids symbols, the checker will still ask for them — follow the policy, then use extra length.
Privacy
The candidate never leaves the browser. Do not test production passwords on a borrowed laptop. Related: /tools/password-generator, /tools/bcrypt-hash. Clearing the field or closing the tab is the cleanup step; Toolora does not save the string.
Limits
No dictionary attack, no entropy bits from a formal model, no passkeys. Keyboard patterns (qwerty) are not specially penalized. Use the checker as a quick local reminder, then store the real secret in a manager.