Password strength checker
How secure is your password? Type it in to see how an attacker would crack it, how long it would take, and whether it has shown up in a breach. The check runs on your device.
Loading the pattern dictionary…
Same password, three attackers
Crack time isn’t a property of the password alone. It depends on where the attacker is guessing. Here is what each scenario means and roughly how fast it goes.
| Scenario | Speed | What slows it |
|---|---|---|
| Guessing at a login page | ~10 / sec | Rate limits, lockouts, CAPTCHAs, 2FA |
| Stolen database, bcrypt or Argon2 | ~10,000 / sec | Deliberately slow, salted hashing |
| Stolen database, MD5 or SHA-1 | ~100 billion / sec | Nothing. Fast hashes are built for speed. |
The rates are round, order-of-magnitude figures for a well-equipped attacker with GPUs; published hashcat benchmarks on current cards land in the same range. You rarely know how a site stores your password, so judge by the offline fast-hash column for anything important.
What makes a password weak
Cracking tools don’t try every combination in order. They start with lists of leaked passwords, then dictionary words with common tweaks: capital first letter, a number at the end, a swapped for @. They add names, dates, keyboard walks like qwerty and 1qaz2wsx, and repeats. A password built from those pieces falls fast however long it looks.
This checker uses zxcvbn (the TypeScript port of Dropbox’s estimator) to split your password into those pieces and count the guesses each one costs. That’s why Summer2024! scores worse than a shorter random string.
Making it stronger
- Let a password generator choose it: 16+ random characters.
- For passwords you must remember, use a six-word passphrase.
- Never reuse a password. One breach then unlocks every account that shares it.
- Turn on two-factor authentication. It blocks most online guessing outright.
Want the maths behind the numbers? The entropy calculator shows the formula.
Questions people ask
Is it safe to type my real password here?
The strength check runs entirely in your browser; the password is never sent anywhere. The optional breach check sends only the first 5 characters of the password’s SHA-1 hash to the Have I Been Pwned Pwned Passwords service, which returns hundreds of possible matches that your browser compares locally. Your password and its full hash never leave the device.
How does this checker score passwords?
It uses zxcvbn, the open-source estimator originally built by Dropbox. zxcvbn looks for the patterns real cracking tools try first: common passwords, dictionary words, names, keyboard walks like qwerty, dates, repeats, sequences and l33t substitutions. It estimates how many guesses an attacker would need and converts that into crack times.
Why does my “complex” password score low?
Because complexity rules are predictable. P@ssw0rd2024! has upper and lower case, digits and a symbol, but it is a dictionary word with common substitutions and a year, which crackers try within seconds. Length and randomness matter; character variety alone doesn’t.
How long would it take to crack my password?
It depends on the attacker. Guessing through a website’s login is limited to a handful of tries per second. An attacker with a stolen database of fast, unsalted hashes can try around a hundred billion guesses per second on GPUs. The results show all three scenarios so you can judge your real risk.
What should I do if my password appears in a breach?
Stop using it everywhere, change it on every site where you used it, and turn on two-factor authentication. A breached password is added to attacker wordlists and will be tried against other services automatically.
What counts as a strong password?
One that needs more guesses than any attacker can afford. In practice: a random password of 16 or more characters from a password manager, or a passphrase of six or more random words. Both come out as “very strong” here.