Password Strength Checker

1. 1Type or paste a password into the box.
2. 2Read the strength score and the estimated time to crack it.
3. 3Look at the patterns found — dictionary words, dates, keyboard runs — and the suggestions.
4. 4Clear the box when you have finished.

Counting character types is a poor measure of strength: “P@ssw0rd1!” ticks every box but falls almost instantly, because attackers try common words with predictable substitutions first. This tool uses zxcvbn, an estimator originally developed at Dropbox, which looks for the patterns people actually use — dictionary words and names, look-alike substitutions, keyboard runs such as qwerty, repeats, sequences and dates — and estimates how many guesses an attacker would need.

That guess count becomes a crack time under four scenarios: an online attack limited to 100 guesses an hour, an online attack at 10 guesses a second, an offline attack on a slow password hash at 10,000 guesses a second, and an offline attack on a fast hash at 10 billion guesses a second. The score from 0 to 4 summarises the result; aim for 4 and treat anything below 3 as weak.

The estimator and its word lists are downloaded to your browser the first time you use the tool and run there. The password is not sent to this site or anyone else — which is also why the tool does not check it against lists of breached passwords, since that would mean contacting an outside service.

The estimate describes how guessable a password is, not whether it is safe. A strong password that has leaked in a breach, or that is reused on several sites, is still unsafe.