Advanced Strength Checker
Deep analysis of your password's entropy and crack-time resistance.
timer Time to Crack
lightbulb Suggestions
How to use the strength checker
Type or paste a password. As you type you'll see a strength rating from Very Weak to Very Strong, an entropy estimate in bits, how long it would take to crack in two attack scenarios, and concrete suggestions for improving it. The analysis runs entirely in your browser: the password is never transmitted or stored.
How strength is measured
Simple strength meters just count character types, which is why they rate P@ssw0rd1 as “strong”. This tool uses zxcvbn, an open-source estimator originally developed at Dropbox, which thinks like a password cracker. It looks for dictionary words, common passwords, names, keyboard patterns like qwerty, repeats, sequences, dates and leetspeak substitutions, then estimates how many guesses an attacker would need.
Understanding the results
| Result | What it means |
|---|---|
| Entropy (bits) | Roughly log2 of the number of guesses needed. Every extra bit doubles the work. Aim for 60+ bits for online accounts and 80+ for anything that could be attacked offline. |
| Online attack (10 guesses/second) | An attacker trying passwords against a live login page that limits attempts. |
| Offline attack (10 billion guesses/second) | An attacker who has stolen a database of fast, unsalted hashes and is cracking them on GPUs. This is the worst case and the one to plan for. |
| Suggestions | Specific weaknesses zxcvbn found, such as “This is a top-100 common password” or “Avoid dates and years”. |
How to fix a weak password
- Add length first. Each extra random character or word helps more than a symbol substitution.
- Remove personal information such as names, birthdays, phone numbers and pet names.
- Avoid predictable tweaks like a capital first letter and
!or123at the end. Crackers try these first. - Or simply replace it with a new one from the random password generator or passphrase generator.
Frequently asked questions
Is it safe to type my real password here?
The check happens locally and nothing leaves your device. Still, good practice is to test passwords similar in style to yours rather than the exact one for a critical account.
A strong score here, but my password was still in a breach?
zxcvbn estimates guessability, not breach history. Check it in the breach checker too. If it has leaked, it is unsafe regardless of its score.