Free Password Strength Checker
Check password strength offline: guess estimate, common password and pattern detection, crack times for online and offline attacks, plus tips.
Loading tool…
How to check how strong a password is
Estimate how many guesses a password would take, which patterns weaken it and how long it resists attacks, all in this page.
- Type or paste the password. It stays masked unless you press Show.
- Read the strength label and score from 0 (very weak) to 4 (very strong).
- Check Patterns found: common passwords, keyboard walks, sequences, repeats, dates and dictionary words.
- Compare the estimated crack times for the four attack models, or set your own guesses per second.
- Follow the suggestions, then press Clear when you are done.
When to check a password's strength
Most sign-up forms only check whether a password has a capital letter, a number and a symbol. Attackers do not care about those rules. They start with lists of leaked passwords, common words, names, dates, keyboard patterns and predictable substitutions, then move on to brute force only when those fail. A password like Password123! passes typical rules and still falls quickly.
This checker estimates strength the way an attacker would approach it. It is useful when choosing a new master password for a password manager, when explaining to colleagues why a policy is not enough, or when you want to see why a passphrase beats a short complex password. For a new random password, the Password Generator creates one in one click.
Worked example: three passwords compared
Summer2024! has 11 characters from all four character groups, so a naive pool calculation gives about 72 bits. The checker finds Summer, which is in the top 1,000 leaked passwords, and 2024, a recent year, leaving only the ! to brute force. Its estimate is about 6.5 million guesses, roughly 23 bits, scored Fair. At the offline fast-hash speed of 10 billion guesses per second that is less than a second; at 10 thousand per second against bcrypt, about 11 minutes; against a login limited to 100 tries an hour, about 7 years.
P@ssw0rd is worse: after undoing the @ and 0 swaps it is the classic password, so the estimate is just 16 guesses, scored Very weak. Compare tulip-orbit-canvas-mango, four unrelated words. With the dictionary option on, each word is recognized, yet the estimate is still about 1.3 times 10 to the 23 guesses, around 77 bits, scored Very strong, and every attack model shows centuries. That is why long random passphrases are recommended.
How the estimate is calculated
The checker looks for patterns: the 1,000 most common passwords from the public SecLists collection, look-alike substitutions such as @ for a and 0 for o, keyboard walks on QWERTY, QWERTZ, AZERTY and number pad layouts, repeated characters or chunks, alphabet and number sequences, dates in day-month-year, month-day-year and year-month-day orders, years, and optionally about 38,000 English dictionary words. Each pattern gets a guess cost; a common password costs its rank, a keyboard walk costs about 50 guesses per character, and a year costs 200.
It then finds the cheapest way to cover the whole password with patterns, charging the size of the character pool for every character no pattern explains. The total guesses give the pattern-aware entropy (log2 of guesses) and a score: under a thousand guesses is very weak, under a million weak, under 100 million fair, under 10 billion strong, and anything above very strong. Crack times divide the guesses by each assumed attack speed. These speeds are illustrative models, not measurements, so the custom field lets you test your own assumption.
Common mistakes
Relying on character-set entropy is the biggest mistake. Many meters multiply length by the size of the character set, which rates Summer2024! at over 70 bits when its realistic strength is closer to 23. Substituting symbols for letters, adding 1 or ! at the end, and capitalizing the first letter are exactly the tricks cracking tools try first.
The other mistake is focusing on strength and ignoring reuse. A very strong password leaked from one site is useless everywhere else it was used, because attackers try leaked email and password pairs on other services. Use a unique password per account, a password manager to remember them, and two-factor authentication where available. Avoid typing a password you currently use into any website you do not trust; this page never sends it, but good habits matter.
Useful tips and limitations
- Length beats complexity: four or five random unrelated words are stronger than a short word with symbols swapped in.
- A strong password still fails if it is reused. Use a password manager and a different password for each account.
- Turn on Show only when nobody can see your screen; found patterns are masked with dots while the password is hidden.
- For accounts that matter most, aim for Very strong and pair it with two-factor authentication.
Common questions
Is my password sent anywhere?
No. The analysis runs in JavaScript on this page with no network request containing the password, and it is not saved or logged. The optional dictionary is a public word list downloaded from this site.
How are crack times calculated?
The estimated number of guesses is divided by an assumed attack speed: about 100 per hour for a rate-limited login, 10 per second without limits, 10 thousand per second for slow hashes such as bcrypt, and 10 billion per second for fast unsalted hashes.
Why does my long password still score low?
Length only helps if it is unpredictable. A common password, a keyboard row, a date or a repeated chunk is tried early by attackers no matter how many characters it has.
Is this the same as zxcvbn?
It follows similar ideas (pattern matching and guess estimates) but is a smaller, independent implementation with its own lists, so scores can differ from zxcvbn and from other meters.
Does the checker know if my password was leaked?
It only knows the 1,000 most common leaked passwords bundled in the page. It does not check breach databases, because that would require sending data about your password.
What score should I aim for?
Strong (3) or Very strong (4). For a master password or email account, use a long passphrase or a generated password that reaches Very strong.
The password never leaves this page: it is not sent, saved in storage or logged. Closing or clearing the page removes it.