Password Strength Checker
Type a password to see how quickly it could be guessed. The checker looks for common passwords, names, words, dates, keyboard patterns and l33t substitutions, and suggests how to make it stronger.
INPUT
Loading word lists…
RESULT
The score, crack times and tips appear here.
Your password is checked in your browser and never leaves this page.
How to check a password
Type or paste it
The password stays hidden unless you choose Show. It is checked on this device as you type.
Read the score
The score runs from 0 (very weak) to 4 (very strong) and is based on how many guesses an attacker would need.
Follow the tips
Warnings point out what makes it weak, such as a common password or a date. Longer, less predictable passwords score higher.
How the estimate works
The checker uses zxcvbn-ts, an open-source estimator modelled on how real password-cracking tools work. It splits the password into the pieces it finds, such as dictionary words, names, years, repeats and keyboard rows, and counts how many guesses each piece would take. It knows nearly 50,000 common passwords, English words, names and Wikipedia terms, and words in German, French, Spanish, Turkish or Arabic when the page is in one of those languages.
What the crack times mean
They are estimates for four situations: an online attack on a site that limits login attempts (100 guesses an hour), an online attack without limits (10 a second), a stolen database protected by a slow hash such as bcrypt (10,000 a second) and one protected by a fast hash (10 billion a second). Real attackers vary, so use the times to compare passwords, not as a promise.
Frequently asked questions
Is my password sent anywhere?
No. The check runs in your browser and the password never leaves this page. The word lists are part of the page's code and download when the page opens; nothing you type is sent back.
Does it check whether my password was in a data breach?
No. That would mean sending part of the password, or of its hash, to a breach database, so this tool doesn't do it. It does recognise the most common passwords, which are the ones that appear in leaks again and again.
Why is my long password rated weak?
Length only helps when the content is hard to guess. A common phrase, a keyboard row such as qwertyuiop, a repeated word or a name with a year is found quickly however long it is. Random words or a password generator give far better results.