Password Strength Checker

About Password Strength Checker

This tool scores a password from 0 to 4 using zxcvbn, an estimator that looks for dictionary words, keyboard runs, repeated characters, dates and common substitutions instead of just counting character classes. It is meant for anyone choosing a new password or auditing an old one, and it reports an estimated offline crack time alongside written suggestions.

How to use it

1. Type or paste the password into the Password field.
2. Select Check Strength to run the estimate.
3. Read the label (Very Weak through Strong) and the score out of 4 shown in the badge.
4. Look at Crack Time (offline) to see how long a slow-hashing attack would need on average.
5. Follow the Suggestions line, then test a longer or less predictable variant and compare.

Predictable versus long passphrase

password123, then Tr0ub4dor&3, then correct horse battery staple

password123 scores 1/4 (Weak) with a crack time of about 51 seconds and the advice to add more uncommon words. Tr0ub4dor&3 scores 4/4 with about 4 months. The four-word passphrase scores 4/4 with about centuries.

When to use it

• Checking whether a memorable passphrase you plan to use for a password manager master key is actually hard to guess.
• Showing a colleague why swapping letters for symbols in a common word barely helps.
• Auditing a shared service password before deciding whether it needs to be rotated.
• Comparing two candidate passwords to see which one an attacker with a dictionary would find first.

Questions about Password Strength Checker

Does the password leave my browser?

No. The estimate is calculated by a JavaScript library running on the page, with its English dictionary bundled in, so the text you type is never sent to a server by this tool.

Why does a short password with symbols score worse than a long plain one?

The estimator models how attackers actually guess. A substituted dictionary word is a small search space, while several unrelated words multiply the possibilities quickly, so length and unpredictability beat clever punctuation.

What does the offline crack time assume?

It uses the slow-hashing offline scenario, meaning an attacker who stole a hash database protected by a deliberately expensive algorithm and tries about ten thousand guesses per second. A fast hash would fall much sooner.

Is a score of 4 a guarantee?

No. A high score only says the password is hard to guess statistically. It cannot know whether you reused it on another site or whether it already appears in a breach list, so use a unique password everywhere.

Why is the warning line sometimes empty?

The estimator only attaches a specific warning when it finds a recognizable pattern such as a top-ten common password. Other weak choices still get suggestions but no named warning.

Related tools

• Safe URL CheckerCheck if a URL is safe to visit
• Meta Tags CheckerCheck meta tags on a webpage
• File MIME Type CheckerCheck the MIME type of a file
• Gravatar CheckerCheck if an email has a Gravatar
• URL Redirect CheckerCheck URL redirects and status codes
• Security headers checkerFetch a URL and grade its HTTP security headers from A+ to F.