Password Strength Checker
Honest strength analysis with zxcvbn: your password is matched against real cracking dictionaries and patterns, and rated in estimated guesses with the reasons listed. Fully local; nothing you type leaves the browser.
Site policy (advanced)
EFF long list: 7,776 words, each independently chosen word adds 12.9 bits. Six words is EFF's recommendation for most uses.
A PIN's safety comes from the device's lockout policy, not from its size. Never use a PIN as a website password.
Exact for this randomly generated secret: the entropy of the generation procedure itself, including any required-class constraint.
| Online, throttled 100 guesses per second | ... |
|---|---|
| Offline, fast hash 10 billion guesses per second (MD5-class, GPU rig) | ... |
| Offline, strong KDF 10 thousand guesses per second (bcrypt/Argon2) | ... |
Generated locally with crypto.getRandomValues; generation works offline. Nothing is stored, and nothing leaves your browser unless you click the breach check.
Test your own password
Runs locally with zxcvbn, the pattern-and-dictionary estimator: it recognizes tens of thousands of common passwords, names, words, dates, keyboard walks, sequences, repeats and leetspeak. Results for a typed password are ESTIMATES of guessing resistance, a different thing from the exact entropy shown for generated secrets above.
Estimated guessing resistance for a human-chosen password. No exact bit count exists for text a person made up.
| Online, throttled 100 guesses per second | ... |
|---|---|
| Offline, fast hash 10 billion guesses per second | ... |
Optional and button-triggered: the check hashes your password locally with SHA-1 and sends only the first 5 characters of the hash to haveibeenpwned.com, with response padding enabled so even the response size reveals nothing. The password itself never leaves your browser.
Why most strength meters lie to you
The classic meter multiplies password length by the size of the character pool it sees. By that math, "P@ssword2024!" looks like 85 bits of high-grade randomness; in reality it is a top-100 password with two of the most common decorations in existence, and cracking rigs try exactly that shape first. Pattern-based estimation inverts the perspective: model the attacker's dictionaries and rules, and price the password at the cheapest way to reach it. That is what zxcvbn does here, and it is why a random 12-character string can outscore a 30-character sentence built from song lyrics.
Read the recognized-pattern list under your result: it is the attack plan. Every entry, a dictionary word, a date, a keyboard walk, is a shortcut a cracker gets for nearly free. A strong password is one for which that list is empty and the only path is brute force.
Password strength FAQ
How does this strength checker work?
It runs zxcvbn locally in your browser: the estimator models how crackers actually work, matching your password against tens of thousands of common passwords, English words, names, dates, sequences, repeats, keyboard walks and leetspeak substitutions, then estimates how many guesses the cheapest combination of those patterns would take. The result is a 0 to 4 score and an estimated guess count with the recognized patterns listed, so you can see exactly why.
Why does it not show entropy in bits like other checkers?
Because exact entropy does not exist for text a human made up. Checkers that show bits for typed passwords compute length times log2 of the character pool, which assumes each character was drawn at random; that formula rated the famous phrase "correct horse battery staple" at 165 bits when it is one of the most guessed strings on earth. For typed input this page reports estimated guessing resistance. Exact bits appear only in the generator above, where the randomness is actually controlled.
Is it safe to type a real password here?
The analysis runs entirely in your browser: no keystroke, hash or result is transmitted or stored, and the page works offline. That said, the safest habit is testing candidate patterns rather than live credentials, and the optional breach check is a separate button that sends only a 5-character hash prefix when you click it.
What does a score of 3 or 4 actually mean?
The scores are calibrated to attack scenarios: 0 to 1 falls to online guessing in minutes to hours; 2 survives online attacks but not an offline crack of a stolen database; 3 (roughly 10^8 to 10^10 guesses) resists offline attacks against a slow hash; 4 (beyond 10^10) holds up even against fast offline hashing. For anything important, aim for 4, which in practice means a generated password or a real random passphrase.
My password passed. Is it safe to reuse it on several sites?
No. Strength and uniqueness are independent, and reuse is the bigger killer: when any one site leaks, bots replay the leaked pair against every other service within hours, and strength is irrelevant because the password is simply known. One site, one password, no exceptions; a password manager makes that free.
More free tools: Password Generator · Password Breach Checker · Passphrase Generator · PIN Generator · Website Safety Checker