Password Strength Checker: How strong is your password, really?. Input: Values you enter. Output: Results shown on the page. Privacy: Runs in your browser: inputs and files stay on your device and are not uploaded.
How to check your password strength
- Type or paste a password. Use Show to see what you typed.
- The meter rates it from very weak to very strong and estimates how many guesses an attacker would need.
- The crack-time table shows how long an attacker would need in four realistic situations, from a website that limits login attempts to a stolen database attacked with powerful graphics cards.
- Read the findings: common passwords, dictionary words, keyboard patterns, repeats and years are all things password crackers try early.
How the estimate works
Simple strength meters just count character types, so they rate P@ssw0rd1! as strong. Real attackers do not guess randomly: they start with leaked password lists, dictionary words with common substitutions (@ for a, 0 for o), names, years and keyboard walks like qwerty. This checker uses zxcvbn, the open-source estimator from Dropbox (in its maintained zxcvbn-ts version): it splits your password into the cheapest combination of those patterns, using a list of 30,000 leaked passwords, English words, names, dates and keyboard layouts, and counts how many guesses an attacker trying them in that order would need. A long random password scores highly; a long password made of a word plus a year does not.
Crack times are rough, order-of-magnitude estimates. The biggest factors you control are length and unpredictability. A passphrase of four or five random words is both strong and memorable.
Is it safe to type my password here?
The check runs entirely in your browser, and your password is never sent anywhere: the page only downloads the word lists, from this site. Still, the safest habit is to test a password that is similar in style to yours rather than your real one, and never to reuse passwords. Use a password manager and turn on two-factor authentication for important accounts.
What makes a password strong?
Length and randomness. At least 12–15 characters that are not based on words, names, dates or patterns, or a passphrase of four or more random words.
Is P@ssw0rd a strong password?
No. Letter-to-symbol substitutions are among the first variations attackers try, so it is cracked almost instantly.
How long would it take to crack my password?
The table gives estimates for four attack speeds. Against a fast offline attack, anything under about 60 bits of entropy can fall within days.