Your password never leaves this page: the check runs in your browser and nothing is saved or sent.
About the Password Strength Checker
This free password strength checker tells you how hard a password is to guess. Type a password and you see a score from Very weak to Very strong, how long an attacker would need to crack it, and tips to make it better.
Most simple meters only count letters, numbers and symbols. That is not how attackers work. They try the most common passwords first, then words, names, dates, keyboard rows like *qwerty*, and tricks like *p@ssw0rd*. So Password1! passes every "one capital, one number, one symbol" rule, but it is still weak.
This checker uses zxcvbn, an open-source password checker made by Dropbox. It knows lists of common passwords, names and words, and spots patterns, repeats, sequences, dates and l33t swaps. From that it estimates how many guesses a password needs.
Your password stays on your device. The check runs in your browser. The zxcvbn script is downloaded once, but your password is never sent, saved or logged.
Features
- Score from Very weak to Very strong, with a coloured bar
- Time to crack — how long guessing would take online with limits, online without limits, and offline
- Strength in bits — the number of guesses shown as bits
- Smart check — uses zxcvbn, which knows common passwords, words, names, dates and keyboard patterns
- Four simple rules — 12 or more characters, upper and lower case, a number and a symbol, each with a tick or a cross
- Tips — warnings and ideas to make the password stronger
- Show the password — a tick box to see what you typed
- Private — the check runs in your browser; your password is never sent or saved
How to use it
- Type a password in the box Type a password to test. The result updates with each key
- Tick Show the password if you want to see what you typed
- Read the score and the coloured bar: Very weak, Weak, Fair, Strong or Very strong
- Look at the crack times and the strength in bits
- Check the four simple rules: At least 12 characters, Upper and lower case letters, A number, A symbol, like ! ? # %
- Read the tips below the result, change the password, and watch the score go up
What the crack times mean
The checker shows the same number of guesses at three attack speeds:
- Online, with limits — 10 guesses per second. A website that slows down or blocks repeated logins
- Online, without limits — 10,000 guesses per second. A badly protected login
- Offline — 10 billion guesses per second. The attacker has stolen a list of password hashes and uses fast computers. This is the line that matters most, so the tool shows it in bold
Strength in bits is log₂ of the number of guesses. Each extra bit doubles the work for the attacker.
Guesses, score and time to crack
The time depends only on the number of guesses that zxcvbn estimates. This table uses the same speeds and score limits as the tool:
| Guesses needed | Score | Bits | Online, 10/s | Online, 10,000/s | Offline, 10 billion/s |
|---|---|---|---|---|---|
| 100 | Very weak | 7 | 10 seconds | less than a second | less than a second |
| 10,000 | Weak | 13 | 16 minutes | 1 second | less than a second |
| 10 million | Fair | 23 | 11 days | 16 minutes | less than a second |
| 1 billion | Strong | 30 | 3 years | 1 day | less than a second |
| 100 billion | Very strong | 37 | 3 centuries | 3 months | 10 seconds |
| 100 trillion | Very strong | 47 | 3,170 centuries | 3 centuries | 2 hours |
| 1 billion billion | Very strong | 60 | millions of years | 31,709 centuries | 3 years |
zxcvbn gives Very strong from about 10 billion guesses. Even then, an offline attack can be quick, so for important accounts aim higher than the minimum.
How to make a strong password
- Make it long. Length helps more than anything else. 12 characters is a good minimum, 16 or more is better
- Use random words. Four or five random words, like *tulip-orbit-cable-mango*, are long, strong and easy to remember
- Avoid the obvious. Names, birthdays, your pet, your city, sports teams and keyboard rows are tried first
- Do not trust small changes. *Summer2026!* and *P@ssw0rd* are on every attacker's list
- One password per site. When one site leaks, the same password opens your other accounts
- Use a password manager to keep long random passwords, and turn on two-step login where you can
Frequently asked questions
Is it safe to type my real password here?
The check runs only in your browser, and the password is not sent or saved. Still, the safest habit is to test a password that is similar to your real one, not the exact one, on any website.
Why is my password weak when it has a number and a symbol?
The rules are not the problem — patterns are. zxcvbn sees a common word with a capital at the start and *1!* or a year at the end, and it knows attackers try that first.
How long does it take to crack my password?
It depends on how many guesses it needs and how fast the attacker can try. The tool shows three speeds. The offline time is the one to watch, because leaked password lists are attacked that way.
What is zxcvbn?
zxcvbn is a free, open-source password strength estimator made by Dropbox. It is used in many websites and apps. Its name comes from the bottom row of letters on a QWERTY keyboard.
Are the crack times exact?
No. They are estimates. Real attacks can be faster with better hardware, or slower if the site stores passwords well. Use the times to compare passwords, not as a promise.
Good to know
- The checker reads the first 100 characters of the password
- The written tips from zxcvbn are in English
- If the zxcvbn script cannot load, you still see the four simple rules
- A strong password does not help if the site leaks it in plain text — use a different password on every site
- Need a new one? The Password Generator makes long random passwords
Related tools
- Password Generator — make a strong random password
- Hash Generator — see the MD5 and SHA hash of a text
- WiFi QR Code Generator — share your WiFi without typing the password
- Random Number Generator — pick random numbers
- Character Counter — count the characters in a text
