A password strength checker that thinks like an attacker
Most password meters just count character types, so P@ssw0rd1 looks “strong”. This password strength checker works the way real cracking tools do: it looks for common passwords, dictionary words and names, l33t substitutions, keyboard walks such as qwerty, sequences, repeated blocks, dates and years, then finds the cheapest way an attacker could guess the whole password.
You get an estimate of the number of guesses needed, how long that takes under four realistic attack scenarios, a list of the weak patterns found and specific advice for fixing them. The analysis runs entirely in your browser and the password is never stored. An optional breach check uses the Have I Been Pwned k-anonymity API, which never receives your password.
How to use the Password Strength Checker
- Type or paste the password into “Password to check”. Press “Show” if you want to see it and the matched patterns in plain text.
- Read the rating and the estimated number of guesses at the top.
- Look at “Patterns found” to see exactly which parts make the password predictable.
- Follow the tips under “How to improve it”, and compare the crack times in the table.
- Optionally press “Check if breached” to see whether the password appears in known data breaches.
Password Strength Checker features
Pattern-aware estimate
Common passwords, words, names, reversed words, l33t swaps, keyboard and number-pad walks, sequences, repeats, dates and years are all detected and scored.
Four attack models
Crack times for rate-limited and unthrottled online attacks and for offline attacks on slow and fast password hashes.
Specific, current advice
Tips follow NIST SP 800-63B: favour length, avoid predictable patterns, use unique passwords and two-factor authentication.
Privacy-safe breach check
Only the first five characters of the SHA-1 hash are sent; the match happens in your browser.
Hidden by default
The password field is masked, and matched fragments are shown as dots until you choose to reveal them.
How the strength estimate works
The checker scans the password for every pattern it knows and gives each one a guess count. A common password is worth its position on the list, a word is worth its approximate popularity multiplied by its capitalisation and l33t variants, a year is worth the distance from the current year (at least 20), and a keyboard walk is worth the number of walks of that length and shape. Any characters left over are treated as random, using the size of the character pool.
It then searches for the sequence of patterns that covers the password with the fewest total guesses — the same idea as the open-source zxcvbn estimator described by Daniel Lowe Wheeler (USENIX Security 2016). Example: Summer2024! splits into the word “summer” with a capital S, the year 2024 and one symbol, which together need only a few million guesses — very weak despite using four character types.
The built-in dictionary is deliberately small (several hundred of the most common breached passwords plus a few hundred popular words and names), so the result is an upper bound: real attackers use lists with billions of entries. If your password is made of ordinary words, assume it is weaker than shown.
Understanding the attack scenarios
The rating uses the toughest common case — the fast-hash offline attack — because you cannot know how every website stores your password. Times are estimates of the guesses needed, not guarantees.
| Scenario | Speed assumed | When it applies |
|---|---|---|
| Online, rate-limited | 100 guesses per hour | Guessing at a real login page that locks or slows down after failures |
| Online, no rate limit | 10 guesses per second | A poorly protected login or API |
| Offline, slow hash | 10,000 guesses per second | A stolen database hashed with bcrypt, scrypt or Argon2 |
| Offline, fast hash | 10 billion guesses per second | A stolen database using MD5, SHA-1 or NTLM, cracked on GPUs |
What makes a password strong in 2026
- Length. NIST SP 800-63B (revision 4) requires at least 15 characters for passwords used on their own and at least 8 when combined with another factor, and asks services to accept at least 64.
- Unpredictability. Randomly generated passwords or passphrases beat clever substitutions every time.
- Uniqueness. Reusing a password lets one breach unlock many accounts — this is how most account takeovers happen.
- Not breached. Services should block passwords that appear in breach lists; you can check yours here.
- No forced rotation. Change a password when there is evidence it was exposed, not on a calendar schedule.
Password Strength Checker FAQ
Is it safe to type my real password into a password strength checker?
Here, yes: the analysis is plain JavaScript running on your device and makes no network request. Only the optional breach check contacts a server, and it sends just five characters of a hash. As a habit, though, never type a password into a site you do not trust.
How does the Have I Been Pwned check protect my password?
Your browser computes the SHA-1 hash of the password and sends only the first 5 of its 40 hex characters. The service replies with every breached hash that starts with those characters (typically several hundred, plus random padding entries) and the comparison happens locally. This is called k-anonymity.
Why is my password with symbols rated weak?
Because symbols placed in predictable ways — @ for a, ! at the end, a capital first letter — are exactly what cracking software tries first. Length and randomness matter far more than character variety.
Why does this checker give a different score from other sites?
Meters use different dictionaries, attack assumptions and scales. This one estimates guesses from detected patterns and rates against a fast offline attack, which is stricter than meters that only count character types.
What is a good password strength?
Aim for “Strong” or better: at least 75 bits, which would take over 100,000 years at ten billion guesses per second. A random 13-character password or a six-to-seven-word passphrase gets you there.
Does “not found” in the breach check mean my password is safe?
No. It only means the exact password is not in the Have I Been Pwned collection. A short or patterned password can still be guessed quickly, so look at the estimate as well.