Password Strength Checker

Guide & FAQ

The check runs in your browser. The password is not sent or stored anywhere. Still, do not type a password you use today into any website you do not trust: test a similar one instead.

Guide: Password Strength Checker

How to check a password

Type or paste a password into the box. The meter, the entropy estimate, the crack times and the list of weaknesses update as you type. Use the Show button to see what you typed.

What the score means

  • Very weak and Weak: found quickly by common guessing lists. Do not use it.
  • Fair: resists casual attacks but not a targeted one.
  • Strong and Very strong: would take an attacker an impractical number of guesses, even offline.

Patterns attackers try first

Real attacks do not guess blindly. They start with leaked passwords, common words with small changes, names and dates, keyboard patterns and repeated or sequential characters. That is why Tr0ub4dor&3 is weaker than four random words, even though it looks complicated. The "What we found" list shows which of these patterns your password contains.

Privacy

The estimator and its dictionaries are loaded as files from this site and run inside the page. No password is transmitted or kept. Entropy figures are estimates of guessing effort based on the patterns found.

FAQ

Is it safe to type my password here?

The check runs entirely in your browser and the page does not send the password anywhere or store it. As a general rule, though, test a password that is similar to yours rather than the real one, and only on sites you trust.

How is the strength calculated?

The tool uses zxcvbn-ts, an open-source estimator. Instead of only counting character types it looks for common passwords, dictionary words, names, keyboard runs like qwerty, repeats, sequences, dates and common letter swaps such as @ for a, then estimates how many guesses an attacker would need.

Why is Password1! rated weak when it has upper case, a digit and a symbol?

Attackers know these habits. Password1! is a common word with a predictable capital letter, number and symbol added at the end, so it falls early in guessing lists. Length and unpredictability matter more than rules.

What do the crack time rows mean?

They show how long guessing would take under four scenarios: a throttled online login, an unthrottled online login, an offline attack on a slowly hashed database and an offline attack on a fast hash with specialised hardware. They are estimates, not promises.

What makes a password strong?

Length and randomness. A long random password or a passphrase of five or more unrelated words, unique to each account and kept in a password manager, will score high.

Open-source licences

  • @zxcvbn-ts/core 4.2.0, language-common 4.1.3, language-en 4.1.1: MIT