Password Strength Checker

What the meter is actually measuring

The engine behind this page is zxcvbn, an open-source password-strength estimator originally written by Dropbox. It does not just count characters. It matches your input against dictionaries, common passwords, dates, keyboard walks, repeats, and leetspeak substitutions. The score you see is how many realistic guesses an attacker would need, expressed as a bucket from 0 to 4.

The crack-time figure assumes the attacker has your leaked hash and is running an offline attack at 10,000 guesses per second, roughly what bcrypt or PBKDF2 allow on commodity hardware. That is the correct threat model for anything worth protecting. Online attempts against a real login form are much slower and usually rate-limited.

What each score means

0 · Very weak

Guessable in under a second. Common password, dictionary word, obvious keyboard walk, or a leetspeak variant of one of those. Replace it now.

1 · Weak

Guessable in minutes to hours. Recognisable pattern with light obfuscation. Still very risky for anything that matters.

2 · Fair

Takes weeks to guess offline. Fine for low-stakes accounts. Not fine for email, banking, or your password manager.

3 · Strong

Takes years to crack offline. Suitable for most accounts if stored uniquely per site.

4 · Very strong

Centuries to crack. Appropriate for master passwords and disk encryption. Aim for this on the passwords that unlock everything else.

How to get to Very strong

• Length first. A 20-character random password beats an 8-character one with symbols, every time.
• Passphrases work. 5 or more random words from a large wordlist puts you in the Very strong bucket with something you can actually remember.
• Kill the pattern. Dates, keyboard walks (qwerty, 12345), and dictionary substitutions (P4$$w0rd) all get scored down. Random is the goal.
• Never reuse. A unique password per account means a breach of one site cannot unlock the others. This is the main reason to use a password manager.
• Turn on MFA. Even a very strong password can be phished. A second factor blocks that path.

How this tool handles your data

• Everything runs in your browser via the zxcvbn library.
• Nothing you type is sent to a server, stored, or logged.
• The site uses Google Analytics for page-view counts. It does not observe the analyzer input.
• Open DevTools → Network before you type. You will not see a request go out.

Frequently asked

Is my password sent to a server?

No. The strength check runs entirely in your browser using zxcvbn, a client-side JavaScript library. Nothing you type is transmitted, stored, or logged. Open your browser DevTools, switch to the Network tab, then type. You will not see a request go out.

What does the strength score mean?

zxcvbn returns a score from 0 (very weak, guessable instantly) to 4 (very strong, would take centuries to crack offline). The score factors in dictionary matches, keyboard walks, repeats, dates, and leetspeak, not just raw length.

What does "time to crack" assume?

The time shown assumes an attacker has your leaked password hash and is running an offline slow-hash attack at 10,000 guesses per second, roughly what bcrypt or PBKDF2 allows on commodity hardware. Online attempts against a live login page are far slower and often rate-limited.

What is entropy in this context?

Entropy in bits is a measure of how many guesses an attacker would have to make. 40 bits is guessable in a day on a modest GPU. 60 bits takes years. 80 bits is out of reach for anyone short of a nation-state. Each extra bit doubles the guesses.

Should I trust this over my password manager's built-in check?

They are consistent. 1Password and Bitwarden both use zxcvbn or an equivalent algorithm. This page is useful when you are away from your manager, checking a password before you paste it in, or comparing a few candidates.

Why does a random 10-character password score higher than my long personal password?

Because dictionary words, dates, and phrases are much easier to guess than the length suggests. "Passw0rd!" scores about 0 despite mixing classes. A random 10-character password scores 3 or 4 because it has no exploitable pattern.

Does the checker recognise leetspeak?

Yes. Substituting 4 for A or 3 for E does not fool zxcvbn. It has a substitution map and will still spot "P4ssw0rd" as a variant of "password" and score it accordingly.

What should I do if my password scores 0 or 1?

Generate a new one. Head to the password generator, pick random or passphrase mode, and save the result to a password manager. A 5-word passphrase from the generator scores 4 out of 4 every time.