About the Password Strength Checker
Find out how long a password would take to guess, and why. Type a password and see its strength, the estimated number of guesses an attacker would need, and specific warnings such as 'this is a common password' or 'dates are easy to guess'.
The check runs entirely in your browser. The password isn't sent anywhere, stored or logged, and the page keeps working with the internet switched off once it has loaded.
How it works
Strength is estimated by zxcvbn, the open-source estimator created at Dropbox and described in a peer-reviewed paper (Wheeler, USENIX Security 2016). Instead of counting character types, it looks for what attackers actually try first: passwords from leaked lists, dictionary words, names, keyboard runs like 'qwerty', repeats, sequences, dates and common letter swaps such as @ for a.
It adds up the cheapest way to guess each part of the password and turns that into a number of guesses, then into a score from 0 to 4. The crack times show how long that many guesses would take in four standard situations, from a website that blocks repeated logins to an attacker with a stolen, poorly protected password database.
time to crack = estimated guesses ÷ guesses per second score 0: under 10³ guesses · 1: under 10⁶ · 2: under 10⁸ · 3: under 10¹⁰ · 4: 10¹⁰ or more
Assumptions and limits
- This is an estimate of guessability, not a guarantee. A password that has appeared in a data breach is weak however long it is, and this page can't check breach lists without sending data off your device.
- Words and names come from English dictionaries and common international password lists. Words from other languages may be rated stronger than they really are.
- Only the first 100 characters are analysed; longer passwords are very strong unless they repeat a pattern.
Worked examples
'P@ssw0rd!' ticks every box and is still weak
It has capitals, numbers and symbols, but it's 'password' with predictable swaps. zxcvbn spots that and rates it score 1 (weak): about 10,000 guesses, a fraction of a second offline.
A passphrase of four random words
'correct horse battery staple' style passphrases (from the XKCD comic) score 4. Each random word adds thousands of possibilities, so length beats complexity, as long as the words are picked at random, not as a phrase.
A random 14-character password
A password like xK9#mQ2$vL7pZ4 from a password manager has no patterns to exploit, so it needs around 10¹⁴ guesses: centuries online, hours for a fast offline attack on an unprotected database.
The four attack scenarios
These are the standard rates used by zxcvbn; real attacks can be faster or slower.
| Scenario | Guesses per second | Example |
|---|---|---|
| Online, with a login limit | about 0.03 (100 an hour) | a website that slows or locks repeated attempts |
| Online, no limit | 10 | a poorly protected login page |
| Offline, slow hashing | 10,000 | a stolen database protected with bcrypt or similar |
| Offline, fast hashing | 10,000,000,000 | a stolen database with weak or no password hashing |
How to use the Password Strength Checker
- Type a password. Use Show to check what you typed.
- Read the score and warnings. The warning explains the biggest weakness.
- Improve it. Make it longer and less predictable until it reaches 'Strong' or better.
Frequently asked questions
Is it safe to type my real password here?
The check happens in your browser and nothing is sent, saved or logged. Even so, it's good practice to test a similar password rather than your real one, and to never reuse a password across sites.
Why is my password with symbols rated weak?
Attackers try common substitutions like @ for a and 0 for o, and add a symbol or number at the end, very early. Those changes add little real uncertainty, so the estimate barely improves.
What makes a password strong?
Length and unpredictability. A long passphrase of several random words, or a random password from a password manager, is far harder to guess than a short one with mixed symbols. NIST's guidelines also advise against forced character rules.
How accurate are the crack times?
They are rough estimates under fixed assumptions about the attacker's speed. Use them to compare passwords and spot weak ones; a real attack depends on how the site stores passwords and whether yours has leaked before.
Does it check whether my password has been leaked?
No. Checking breach databases requires sending at least part of a password hash to a server, and this page never sends your password anywhere. Common leaked passwords are still recognised from the built-in lists.
Sources
This tool runs entirely in your browser. What you enter or upload stays on your device and is never sent to our servers.