Password Strength Checker
Type a password to see its rating, what makes it weak and how long an attacker would need. The breach check uses a privacy-preserving hash prefix, so the password itself never leaves your browser.
Analysed in your browser. Nothing is sent unless you run the breach check, which shares only the first five characters of a hash.
Type a password to rate it.
About this tool
Password strength is about how many guesses an attacker needs. A truly random mix of letters, digits and symbols is strong because every extra character multiplies the possibilities, but people rarely type random strings: they use words, names, years and keyboard walks, which cracking tools try first. This checker starts from the raw entropy and subtracts what those patterns give away, in the spirit of the zxcvbn estimator.
The crack-time table shows four scenarios: a throttled online login, an unthrottled web form, an offline attack against a slow hash such as bcrypt, and an offline attack against a fast hash such as MD5 with a GPU. The breach check queries the Have I Been Pwned database using k-anonymity: only the first five characters of the password's SHA-1 hash are sent, and the matching is done in your browser.
Frequently asked questions
- Is my password sent anywhere?
- No. The rating is computed in your browser. The breach check, which you trigger yourself, sends only the first five hex characters of a SHA-1 hash, which match millions of passwords.
- What makes a password strong?
- Length above all. Four or five unrelated words, or 14+ random characters from a password manager, beat a short password with symbols.
- Why does a long password score low?
- Because it is built from common words, sequences or a year. Attackers guess those combinations long before random strings of the same length.
- What if my password appears in a breach?
- Stop using it everywhere, immediately. Breached passwords are in every cracking wordlist regardless of how complex they look.