Password Strength Checker
See how easy a password is to guess, with crack-time estimates for several attack scenarios and tips to improve it. It never leaves your browser.
The password is checked in your browser only. It is never saved, never put in the URL and never sent anywhere.
Strength
Enter a password to see its strength, crack times and tips.
Need a strong password? Try the Password Generator.
How to use
- Type or paste a password into “Password to check”. The first time, the password dictionaries take a few seconds to load.
- You will see a strength score (0 to 4), the estimated number of guesses, and crack times for four attack scenarios.
- If the password follows a guessable pattern, such as a common password, an English word, a keyboard run or a date, the problem and tips to fix it are listed.
- For a stronger password, create a random one with the Password Generator.
FAQ
Is it safe to type my password here?
The password is analyzed only in your browser. It is not uploaded, not saved in the browser and never put in the URL, and it is gone when you reload the page. Even so, consider testing a similar password built the same way rather than a real one you use.
How is strength calculated?
The tool uses the open-source zxcvbn-ts. Rather than only counting length and character types, it thinks like an attacker: it matches common password lists, English words and names, keyboard patterns, repeats, sequences and dates, estimates how many guesses are needed, and turns that into a score from 0 to 4.
What do the four crack times mean?
Online attacks try passwords on a login page; sites that limit attempts allow about 100 per hour. Offline attacks happen after a site’s password data leaks and the attacker guesses on their own hardware: about 10,000 per second if passwords were stored with a slow hash such as bcrypt, or 10 billion per second with a fast hash such as MD5 on GPUs. To be safe, judge by the fastest scenario.
Why is my score low even with symbols and digits?
Tricks like “P@ssw0rd!”, swapping letters for look-alike symbols or adding digits after a word, are already in attackers’ dictionaries. What really helps is length and unpredictability: a long passphrase of several unrelated words, or a fully random password, beats a short complex one.
Does it work for non-English passwords?
You can enter any characters, but the dictionaries only cover English words and common passwords, so words in other languages are not recognized and may score higher than they deserve.
Does a high score mean the password is safe?
Not necessarily. It is an estimate: a password that has leaked before, relates to your personal details (name, birthday, phone number) or is reused across sites is still at risk. Use a different password for each site, with a password manager and two-factor authentication.