Is it safe to type my real password here?

The check runs entirely in your browser using the open-source zxcvbn library; nothing is transmitted, stored, or logged. You can load the page, disconnect from the internet, and it still works. Even so, the safest habit for your most critical passwords is to test a similar-shaped password rather than the exact one.

How is my password strength calculated?

zxcvbn searches your password for real-world patterns: dictionary words, names, keyboard walks like qwerty, dates, repeats, and common substitutions like @ for a. Strength reflects how many guesses a smart attacker would need, not just length and character variety.

What is a good strength score?

Aim for the top score (4 of 4) with a centuries-scale crack time under the offline fast-hash scenario for anything important. A password manager generating 16+ random characters gets you there automatically.

Password Strength Checker

How strong is your password, really? Pattern-aware analysis with realistic crack-time estimates, not naive length math.

Runs entirely in your browser. Nothing you type or generate is ever sent to a server.

Type a password to test

Online attack: -
Offline, slow hash: -
Offline, fast hash: -

Why this checker is different from most

Many strength meters just count length and character types, so they rate P@ssw0rd2024! as strong. It is not: attackers try dictionary words with common substitutions first. This page uses zxcvbn, the analyzer originally built at Dropbox, which models how real cracking tools work: wordlists, names, dates, keyboard walks, repeats, and l33t substitutions all shrink your real strength, and the score reflects it.

Reading the three crack times

Online attack: guessing through a login form that rate-limits attempts. Almost any decent password survives this.
Offline, slow hash: the site stored passwords with bcrypt or argon2 and its database leaked. A good password still holds.
Offline, fast hash: the worst case, a leaked database of fast hashes against GPU rigs trying around a trillion guesses per second. Judge your important passwords against this number.

Why a generated password can score lower than you expect

For a password with no recognisable pattern, zxcvbn falls back to a deliberately pessimistic brute-force model rather than assuming the attacker knows which character set you used. A 20-character random string from our generator is around 130 bits, but this page will quote a far shorter time for it. That is the estimator being conservative, not your password being weak: treat the number as a floor.

The reverse is the useful direction. When this page says a password falls quickly, believe it, because that verdict comes from a pattern zxcvbn actually recognised. For the true strength of a random password, use the crack time calculator, which does the keyspace maths directly.

Weak result? Generate a replacement with the password generator or a memorable passphrase, and see strong password examples for patterns that hold up.

Frequently asked questions

Is it safe to type my real password here?: The check runs entirely in your browser using the open-source zxcvbn library; nothing is transmitted, stored, or logged. You can load the page, disconnect from the internet, and it still works. Even so, the safest habit for your most critical passwords is to test a similar-shaped password rather than the exact one.
How is my password strength calculated?: zxcvbn searches your password for real-world patterns: dictionary words, names, keyboard walks like qwerty, dates, repeats, and common substitutions like @ for a. Strength reflects how many guesses a smart attacker would need, not just length and character variety.
What is a good strength score?: Aim for the top score (4 of 4) with a centuries-scale crack time under the offline fast-hash scenario for anything important. A password manager generating 16+ random characters gets you there automatically.