Password Strength Checker
See how many guesses a password would actually take, which weaknesses drag it down, and how long an offline attack would need.
Not sent anywhere. Checked inside your browser.
What actually helps
- Four or five unrelated words beat a short string of symbols.
- Never reuse a password across sites. A breach anywhere becomes a breach everywhere.
- Let a password manager generate and remember them; then only one has to be memorable.
- Turn on two-factor authentication where it is offered. It survives a stolen password.
Not sent anywhere. Checked inside your browser.
How to use
Free to use with no sign-up, no install and no usage limit.
Type a password and the estimate updates as you go. What is counted is the number of guesses an attacker would need, not whether the password satisfies a set of rules.
Rules are the reason this matters. "One uppercase, one number, one symbol" pushes everyone towards Password1!, which satisfies every rule and falls in the first few thousand guesses.
So known passwords, keyboard runs, repeated chunks, letter sequences and trailing years all reduce the score, even when the character mix looks varied. P@ssw0rd is treated as the dictionary word it is.
Length beats variety. A passphrase of ordinary words outscores a short string of symbols here, because each extra character multiplies the search space while a symbol only adds to the alphabet once.
The time shown assumes an offline attack at ten billion guesses a second, which is what a leaked database of badly hashed passwords faces. Guessing against a live login is far slower, so treat the figure as the worst case.
Your password is never sent anywhere. It is not uploaded, not stored, and not logged — everything is calculated inside your browser, and closing the tab is enough to be rid of it.