Password Strength Checker
Type a password to see how guessable it is: a realistic score that spots dictionary words, keyboard patterns, dates and common tricks. You can optionally check whether it appears in known data breaches.
Runs in your browser — nothing is uploaded.
Strength
·
Estimated time to crack
Assuming 100 guesses per hour online (throttled), 10 per second online, 10,000 per second offline against a slow hash and 10 billion per second against a fast hash.
Has it been in a data breach?
Optional and off until you press the button. Only the first 5 characters of the password’s SHA-1 hash are sent to the Have I Been Pwned range service (api.pwnedpasswords.com); the password itself never leaves your browser.
How to use it
- Type or paste a password. The score, estimated crack times and suggestions update as you type.
- Read the warning and suggestions: adding unpredictable words usually beats adding symbols.
- Optionally press “Check breaches” to see whether the password has leaked before.
Frequently asked questions
Is my password sent anywhere?
Not by the strength check: it runs entirely in your browser. This page loads no ads, analytics or third-party scripts and logs nothing. The only network request is the breach check, and only when you press its button.
What does the breach check send?
It uses the k-anonymity range API of Have I Been Pwned: your browser hashes the password with SHA-1 and sends only the first 5 characters of that hash. The service returns every leaked hash starting with them, and your browser looks for the rest locally, so the password and its full hash never leave the page. Requests carry no cookies or referrer and ask for padded responses.
How is the score calculated?
With zxcvbn-ts, which estimates how many guesses an attacker needs given common passwords, names, words, keyboard walks, repeats, sequences and dates, not just length and character types. The score goes from 0 (very guessable) to 4 (very unguessable).
What do the crack times assume?
Four scenarios: an online attack limited to 100 guesses per hour, an unthrottled online attack at 10 per second, an offline attack on a slow hash at 10,000 per second, and an offline attack on a fast hash at 10 billion per second. Real attackers vary; treat them as orders of magnitude.
Should I test my real passwords?
It is safe here, but a good habit is to test the pattern, not the password: if a similar one scores badly, change how you make passwords, and use a generator with a password manager.