Password Strength Checker
Type a password to see its strength score from 0 to 4, the estimated time to crack it and the patterns that weaken it, such as dictionary words, dates and keyboard runs. It uses the zxcvbn estimator in your browser, and the password is never sent anywhere — so it is not checked against breach lists.
Updated
How to use the Password Strength Checker
- 1Type or paste a password into the box.
- 2Read the strength score and the estimated time to crack it.
- 3Look at the patterns found — dictionary words, dates, keyboard runs — and the suggestions.
- 4Clear the box when you have finished.
How it works
Counting character types is a poor measure of strength: “P@ssw0rd1!” ticks every box but falls almost instantly, because attackers try common words with predictable substitutions first. This tool uses zxcvbn, an estimator originally developed at Dropbox, which looks for the patterns people actually use — dictionary words and names, look-alike substitutions, keyboard runs such as qwerty, repeats, sequences and dates — and estimates how many guesses an attacker would need.
That guess count becomes a crack time under four scenarios: an online attack limited to 100 guesses an hour, an online attack at 10 guesses a second, an offline attack on a slow password hash at 10,000 guesses a second, and an offline attack on a fast hash at 10 billion guesses a second. The score from 0 to 4 summarises the result; aim for 4 and treat anything below 3 as weak.
The estimator and its word lists are downloaded to your browser the first time you use the tool and run there. The password is not sent to this site or anyone else — which is also why the tool does not check it against lists of breached passwords, since that would mean contacting an outside service.
The estimate describes how guessable a password is, not whether it is safe. A strong password that has leaked in a breach, or that is reused on several sites, is still unsafe.
Tips and common mistakes
- Test a password with the same structure as yours rather than the real one, if you prefer.
- Aim for a score of 4, and treat anything below 3 as weak.
- Read the patterns found; they explain exactly what to change.
- Remember a strong score does not mean a password is safe if you reuse it or it has leaked.