Free tool · CHECK
Password Strength Checker
Find out how long your password would take to crack, and why. The test runs on your device, nothing is uploaded.
Runs 100% in your browser. Nothing you type or upload is sent anywhere or stored.
Start typing to see the score and crack time.
Scored by zxcvbn-ts running in this tab. Your password is not sent or stored. Strength is not the same as safety: a strong password that leaked is still unsafe, so also run the breach check.
How it works
Password strength is the number of guesses an attacker needs, not how complicated the password looks. This checker uses zxcvbn-ts, a maintained version of the estimator Dropbox built, which looks for the shortcuts real cracking tools use: common passwords, dictionary words, names, dates, repeats, sequences, keyboard walks and l33t substitutions.
It then estimates the guesses needed and converts them to time for four attackers. The online numbers apply when someone types guesses into a login page. The offline numbers apply after a data breach, when the attacker has the password hashes and can guess as fast as their hardware allows.
How to fix a weak result
- Add length. Each extra random word or 2 to 3 random characters multiplies the work.
- Remove anything personal: names, birthdays, pets, teams, the site name.
- Replace it with a passphrase or a generated password.
Strong does not mean unbreached. If a password has appeared in a leak, attackers try it first no matter how it scores, so also run the pwned password check.
Read more: Storing passwords in a notes app.
Questions
It depends on how the attacker guesses. Against a website login with rate limiting, even a mediocre password can last years. Against a stolen database hashed with a fast algorithm, attackers can try billions of guesses per second. This checker shows all four scenarios so you can see the worst case.
The check runs in your browser with the open source zxcvbn-ts library. The password is not sent anywhere, not saved, and not tracked. If you would rather not, type a password with the same structure instead of the real one.
Attackers do not guess character by character. They try dictionary words, names, dates, keyboard patterns and common substitutions like @ for a first. P@ssw0rd2024 looks complex but is built entirely from those patterns, so it falls in seconds.
Aim for Very strong (score 4) on email, banking, Apple Account and your password manager. Strong (score 3) is acceptable for low-value accounts. Anything lower should be replaced.
