Password Strength Checker
Check password strength and estimated crack time. Finds common passwords, l33t tricks, keyboard walks and dates, and gives tips. Analysed in your browser.
How to use Password Strength
- 1Type or paste a password into the box. Use Show to check what you typed.
- 2Read the label, the estimated guesses and bits, and the crack time for four attack scenarios.
- 3Fix what is listed under what lowers the score and follow the suggestions, then try again.
What makes it better
- Very weak to Very strong label with a meter, plus estimated guesses and bits
- Crack times for throttled and unthrottled online attacks and for slow and fast offline hashes, with the assumptions shown
- Detects common passwords, l33t substitutions, keyboard walks, sequences, repeats, years and dates
- Names each weakness and gives two to four concrete suggestions
- Live analysis with no history; Clear removes the value
About Password Strength
Password Strength Checker estimates how many guesses an attacker's program would need for the password you type, and turns that into a label and crack-time scenarios. It looks for the shortcuts real crackers use: common passwords, look-alike substitutions, keyboard walks, sequences, repeats and dates. The analysis happens live in your browser; the password is not stored and is never sent anywhere.
Common uses
- Compare a few candidate passwords or passphrases to see which pattern costs the most strength.
- Show a team or family why Password1! is weak even though it ticks every complexity rule.
- Test the wording of password advice or a sign-up form against realistic guess-based estimates.
- Understand why length and randomness matter more than adding symbols.
Example
Input
Tr0ub4dor&3
Result
Fair
Good to know
- Example: Tr0ub4dor&3 gets a Fair label here. It looks complex but is a common word with predictable substitutions and a short tail.
- This is a heuristic estimate, not a guarantee. It uses only the 1,000 most common passwords from the SecLists project (MIT licence), so real attackers with larger lists will do better than the numbers suggest.
- It cannot know whether a password appeared in a data breach, and that check is not part of this tool. Use a throwaway or example password, not a real one.
Password Strength FAQ
How is the crack time calculated?
The tool estimates the number of guesses a smart cracker needs, then divides by an assumed speed. We use 100 guesses an hour for a throttled login, 10 a second for an unthrottled one, 10,000 a second for a slow hash like bcrypt and 10 billion a second for a fast hash on GPUs.
Why is my long password with symbols rated weak?
Attackers do not try every character combination first. They try common words, substitutions like @ for a, keyboard runs and dates. A password built from those pieces is cheap to guess whatever its length or symbol count, so the estimate drops when patterns are found.
Does a Strong rating mean my password is safe?
No. It means the password is hard to guess by the patterns this tool knows. It cannot tell whether the password leaked in a breach, whether you reuse it elsewhere, or whether a phishing page will collect it, so keep it unique and add two-factor authentication.
Are passphrases better than complex passwords?
Often, yes. Four or more unrelated random words are long, easy to remember and hard to guess when the words are chosen by dice or a generator. A short password with swapped symbols is hard to remember and, as patterns go, easier for crackers to guess.
Is it safe to type my real password here?
Nothing is sent or saved, since the analysis runs on your device. Even so, the safest habit is to test a similar throwaway password rather than a real one, because browser extensions or a shared screen could still see what you type into any web page.