Is it safe to type a real password into this checker?

The check happens on your device and nothing you type is transmitted; your browser’s network panel shows no request while you type, apart from loading the checker library once. As a habit, test a similar invented password rather than one you use.

Why does my password with symbols score as weak?

Attackers try common words with predictable additions first. A capital at the start, a year and an exclamation mark at the end are among the most common patterns, so together they add very few guesses.

What score should I aim for?

Aim for Strong, meaning more than 10 billion guesses, for any important account. That holds up well if a database protected by a slow hash is stolen. For a password manager master password, go well beyond that minimum.

Why does a generated password show fewer bits here?

The generator knows exactly how its passwords were made and reports their true entropy. This checker sees only the finished text and counts random characters cautiously, so it often shows a lower figure for generated passwords.

Does a strong result mean my password cannot be stolen?

No. Strength only measures resistance to guessing. Phishing, malware, reuse across sites and leaked databases can expose any password, so use a unique password for each account and turn on two-step sign-in.

What does “similar to a commonly used password” mean?

The checker found your password, or a version with simple swaps such as @ for a or 0 for o, in its list of passwords that appear frequently in leaked data. Such passwords are guessed early.

Password Strength Checker – Private, In-Browser Test

Attack scenario	Time
Online, rate-limited login 100 guesses an hour	—
Online, no rate limit 10 guesses a second	—
Offline, slow hash (e.g. bcrypt) 10,000 guesses a second	—
Offline, fast hash 10 billion guesses a second	—

How to use the password strength checker

Type or paste a password into the box. The result updates with every key press.
Press “Show” to see what you typed and check it for mistakes, then “Hide” to mask it again.
Read the strength label, the estimated number of guesses and the time each type of attack would need.
Follow the warning and suggestions, then test the improved version.
Press Reset to clear the box; closing the tab clears it too.

How the estimate is calculated

Simple meters count length and character types. They reward Password1! for using four kinds of characters, although it is among the first guesses any cracking tool tries. This checker uses zxcvbn-ts, an open-source estimator that thinks like a password cracker. It splits the password into pieces and matches each piece against tens of thousands of common passwords, English words, first names and surnames, as well as keyboard runs such as qwerty, repeats, sequences, dates and swaps like 0 for o. It then finds the cheapest way to build the whole password from those pieces and counts the guesses that would take.

guesses = cheapest combination of known patterns time = guesses ÷ guesses per second score = Very weak < 10³ · Weak < 10⁶ · Fair < 10⁸ · Good < 10¹⁰ · Strong 10¹⁰+ speeds = 100 an hour · 10 a second · 10,000 a second · 10 billion a second

Worked example

Summer2024! looks varied, yet the checker finds a dictionary word followed by five more characters and estimates 10,010,000 guesses, rated Fair. A login allowing 100 guesses an hour would hold out for about 11 years. If the password database were copied and protected by a slow hash at 10,000 guesses a second, it would fall in about 17 minutes, and with a fast hash in less than a second. Counting length and character types alone would have credited it with 72.3 bits.

Reading the four attack scenarios

Online attacks go through a website’s sign-in form. Most services slow down or lock out repeated attempts, so 100 guesses an hour is a typical ceiling; with no limit at all, about 10 a second. Offline attacks happen after a file of password hashes has been copied. A slow hash such as bcrypt, scrypt or Argon2 holds an attacker to thousands of guesses a second per machine, while a fast or unsalted hash can allow billions. You rarely know how a site stores passwords, so aim for a result that survives the offline rows.

Limits of any strength meter

The estimate covers guessing only. It cannot tell whether a password has already been exposed, reused elsewhere or typed into a fake sign-in page. For random strings, zxcvbn-ts counts cautiously (about ten guesses per character), so a generated password can show a lower figure here than the true entropy reported by the password generator. A quantum computer running Grover’s algorithm would, in theory, halve the bits of a pure brute-force search, but most real attacks rely on the patterns this tool already detects.

If the detailed checker cannot load, for example on a very slow connection, the page falls back to a simple length-and-character-type estimate and says so. That figure is an upper limit, not a dependable rating.

Key features

Pattern-based estimate with common-password, English word and name dictionaries.
Crack-time estimates for four attack scenarios, from rate-limited logins to fast offline hashing.
Plain-language warnings and suggestions for each weakness found.
Masked input with a show/hide button and browser autofill switched off.
The analysis library is hosted on this site and loads only on this page.

Practical use cases

Checking a password habit. Type an invented example in the style you normally use and see which patterns the checker spots.

Explaining a policy. Show colleagues why a season-plus-year password scores poorly and why a password manager with long random secrets works better.

Comparing alternatives. Test a four-word and a six-word passphrase to see what each extra random word adds.

This tool runs entirely in your browser and is provided as-is. See our terms and privacy policy.