Check password strength
Type Tr0ub4dor&3xY!zq and you see 16 characters, 105 bits of entropy, not a common password and centuries to crack. P@ssword1! ticks every symbol rule and still falls in seconds. Free in your browser.
- Free
- Runs in your browser
- No sign-up
- Your data stays on your device
Run — free
Worked example
- Password
- Tr0ub4dor&3xY!zq
- Character count
- 16
- Entropy (bits)
- 105
- Password strength
- fuerte
- Estimated crack time
- siglos
Most password rules reward the wrong things: 'P@ssword1!' satisfies a length-plus-symbol policy and falls to a cracking tool in seconds, while a long, unusual passphrase with no symbols at all can be genuinely strong.
Why length-and-symbol rules keep failing
Composition rules requiring a digit, a symbol and a capital letter were a reasonable idea decades ago, but attackers adapted faster than the rules did: password-cracking dictionaries now include every predictable substitution pattern those rules encourage, from 'a' to '@' and 'o' to '0'. A policy built around character classes measures compliance with a checklist, not actual resistance to a cracking attempt, and it often pushes users toward memorable-but-weak patterns instead of genuinely strong ones.
A brief note on why common-list checks matter so much
Billions of passwords have leaked from breaches over the years, and attackers no longer guess blindly; they run candidate passwords against those known lists first, because a shocking share of the population reuses a small set of predictable passwords and variations. A password can have decent theoretical entropy and still be one of the most common an attacker tries first, which is precisely why entropy alone is an incomplete measure and flagging the most common passwords is not optional.
What you can do with it
Signup form live feedback
Score the password as a user types it and show a real strength meter driven by entropy and common-password matches instead of a checklist of character types.
Password reset enforcement
Reject a new password during reset if it matches the common-password list, closing the loop attackers rely on when they try predictable passwords first.
Bulk credential audits
Run an internal audit of legacy accounts' passwords, where policy allows, to flag accounts sitting on dangerously weak or reused passwords.
Enterprise password policy tooling
Give admins a realistic time-to-crack estimate instead of an arbitrary character-count rule when setting organization-wide password requirements.
FAQ
Does it check against common passwords?
Yes. It flags candidates that match a built-in list of the most common passwords, as part of the assessment, not just a theoretical entropy calculation. It does not query a live breach database, which would mean sending the password to an outside service.
Are submitted passwords stored?
No, submitted passwords are deleted after the retention window and are never used for training or any purpose beyond returning the strength result.
Why is P@ssword1! considered a weak password?
Because cracking dictionaries already include every predictable swap that symbol rules encourage, such as a for @ and o for 0. It meets a length-plus-symbol policy on paper, yet falls to a cracking tool in seconds.
What does password entropy mean?
It is a measure, in bits, of how many guesses a password could require, based on its length and the kinds of characters it uses. A 16-character mix scores 105 bits, but a common password with decent entropy is still tried first.
How long would it take to crack my password?
The check gives a realistic estimate based on how an attacker actually works, not a worst-case theoretical bound. For Tr0ub4dor&3xY!zq the answer is centuries, while predictable variations of common words fall far faster.
Related tools
For developers — API access
Everything on this page is available programmatically. This section is for teams who want to wire it into their own systems; everyone else can just use the tool above.
API endpoint
Prefer to automate it? One authenticated POST creates the task; the result comes back by webhook or a signed link. The same capability also runs here on the web, by email and from Telegram — and soon from our app too.
Call it from your stack
curl -X POST https://api.kit.forhosting.com/verify/password \
-H "Authorization: Bearer $KIT_KEY" \
-H "Content-Type: application/json" \
-d '{"password":"Tr0ub4dor&3"}'const res = await fetch("https://api.kit.forhosting.com/verify/password", {
method: "POST",
headers: {
"Authorization": `Bearer ${process.env.KIT_KEY}`,
"Content-Type": "application/json"
},
body: JSON.stringify({
"password": "Tr0ub4dor&3"
})
});
const { task_id } = await res.json();import os, requests
res = requests.post(
"https://api.kit.forhosting.com/verify/password",
headers={"Authorization": f"Bearer {os.environ['KIT_KEY']}"},
json={
"password": "Tr0ub4dor&3"
},
)
task_id = res.json()["task_id"]<?php
$res = file_get_contents("https://api.kit.forhosting.com/verify/password", false, stream_context_create([
"http" => [
"method" => "POST",
"header" => "Authorization: Bearer " . getenv("KIT_KEY") . "\r\nContent-Type: application/json",
"content" => '{"password":"Tr0ub4dor&3"}',
],
]));
$task = json_decode($res, true);body := bytes.NewBufferString(`{"password":"Tr0ub4dor&3"}`)
req, _ := http.NewRequest("POST", "https://api.kit.forhosting.com/verify/password", body)
req.Header.Set("Authorization", "Bearer "+os.Getenv("KIT_KEY"))
req.Header.Set("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)Example request
{
"password": "Tr0ub4dor&3"
}Example response
{
"task_id": "tsk_a1b2c3d4e5f6a1b2c3d4e5f6",
"type": "verify.password",
"status": "queued",
"_links": {
"result": "/tasks/tsk_…/result"
}
}The API is asynchronous: the call returns a task_id immediately and the result arrives by webhook. Polling is capped at 1 req/s per task.
Pricing
Published price — no tokens, no invented credits. A failed task is never charged.
Errors
| HTTP | Code | Meaning |
|---|---|---|
401 | unauthorized | Missing or invalid API key. |
402 | insufficient_balance | Your balance doesn't cover the task price. |
404 | unknown_type | That task type doesn't exist. |
429 | rate_limited | Too many requests. Use the webhook instead of polling. |
Technical notes
The password strength API measures actual entropy, checks the candidate against a built-in list of the most common passwords, and estimates realistic time-to-crack, so your signup form can guide users toward passwords that are strong in practice, not just on a checklist.
What this endpoint measures instead
The response gives you a strength assessment grounded in how an actual attacker would approach the password, not an arbitrary point score tied to whether it contains an exclamation mark. Call POST /verify/password with a candidate password and the task calculates its entropy based on character set and length, checks it against a built-in list of the most common passwords, and estimates time-to-crack under realistic attack assumptions rather than a worst-case theoretical bound.
Where it plugs into a signup flow
Most integrations call this at the moment a user types a candidate password, showing real-time feedback rather than a rejection after submission; because the task is asynchronous you get a task_id immediately and the result by signed webhook, or via a signed link valid 24 hours if your flow polls instead. At $0.002 per request with failed checks never billed, it's cheap enough to call on every keystroke pause without rationing calls to only the final submit.
What it won't tell you
This endpoint scores the password itself; it says nothing about how your system stores it, and a strong password hashed with a weak, fast algorithm is still a weak system. Strength scoring and secure storage are separate problems that both need solving, and this endpoint solves exactly the first one, deliberately and well.
Technical questions
Is the password strength API free?
The tool above runs free in your browser. The API is paid — each call draws from your prepaid ForHosting KIT balance: top up from $10.00 (it never expires), pay each request's published price, and a call with no balance returns HTTP 402. No subscription, no tokens, and a failed task is never charged.
How is it priced?
$0.002 per request, charged only on a successfully completed check; failed checks are retried automatically up to three times and never billed.
How is this different from a simple regex rule?
A regex rule checks character composition; this endpoint measures actual entropy, common-list membership and estimated time-to-crack, which correlate far better with real-world resistance to cracking.
Can I use this for live typing feedback?
Yes, the low per-request cost and async task_id response make it practical to call on natural pauses as a user types, not only at final submission.
How do I get the result?
By signed webhook, recommended for real-time UI feedback pipelines, or via a signed link valid 24 hours if you prefer to poll.
Does a strong score guarantee my system is secure?
No, this endpoint scores password strength only; secure hashing and storage on your end are a separate requirement that this check does not cover.