Password Strength Checker
Type a password to see how long an attacker would need to guess it. The checker looks for the patterns real cracking tools try first, such as common passwords, words, keyboard rows, dates and l33t substitutions, and never sends your password anywhere.
Checked on your device only. Your password is never sent or saved.
Time to crack
| Attack scenario | Guess rate | Estimated time |
|---|---|---|
| Online, rate-limited login | 100 / hour | – |
| Online, no rate limit | 10 / second | – |
| Offline, slow hash (bcrypt, Argon2) | 10 thousand / second | – |
| Offline, fast hash (MD5, SHA-1) on GPUs | 10 billion / second | – |
Patterns found
- Type a password to see how it would be guessed.
Composition
- At least 12 characters
- At least 16 characters
- Lowercase letters
- Uppercase letters
- Digits
- Symbols or spaces
- Not a common password
How to use the Password Strength Checker
- Type or paste a password into the box. Use the eye button to show or hide it.
- Read the score and bar: 0–1 is easy to guess, 2 is risky, 3 is good and 4 is very strong.
- Check the crack times for the four attack scenarios, from a rate-limited login form to an offline attack on a leaked fast hash.
- Look at the patterns found and follow the warnings and suggestions.
- Press Check Strength to re-run the analysis, for example after switching between zxcvbn and the built-in estimator.
What the strength score means
| Score | Label | Estimated guesses | Protects against |
|---|---|---|---|
| 0 | Too guessable | < 103 | Nothing: found within the first thousand tries |
| 1 | Very weak | < 106 | Only a strictly rate-limited login |
| 2 | Weak | < 108 | Throttled online attacks |
| 3 | Good | < 1010 | Unthrottled online attacks; a leaked slow hash for a while |
| 4 | Very strong | ≥ 1010 | Offline attacks on a slow hash such as bcrypt |
How crack time is estimated
Time = guesses ÷ guesses per second. The guess count is the number of attempts a smart attacker needs if they try likely patterns first, not the size of the whole character space.
Worked example: sunshine2023 is the common password "sunshine" (rank about 20) followed by a recent year (about 20 possibilities). Each part of a longer password counts as at least 50 guesses, so the two patterns give 2! × 50 × 50 + 10,000 ≈ 1.5 × 104 guesses (the factorial covers the order of the parts, the 10,000 term the number of parts). At 10 guesses per second that is about 25 minutes; against a fast MD5 hash it falls instantly. A naive "character-set" formula would claim 12 × log2(36) ≈ 62 bits and centuries, which is badly wrong.
| Password | Main patterns | Typical score |
|---|---|---|
password | top-10 common password | 0 |
P@ssw0rd1 | common password + l33t + capital + digit | 0–1 |
qwerty123 | keyboard row + sequence (and a common password) | 0 |
Jennifer1987 | name + year | 1 |
Tr0ub4dor&3 | uncommon word with l33t + 2 random chars | 2–3 |
correct horse battery staple | four random words | 4 |
x7#Qp!9vLm2@Zr | 14 random characters | 4 |
Patterns attackers try first
- Leaked and common passwords: lists of hundreds of millions of real passwords are tried before anything else.
- Dictionary words and names, including reversed words and capitalised first letters.
- l33t substitutions such as @ → a, 0 → o, 1 → i or l, 3 → e, $ → s. Cracking rules apply them automatically.
- Keyboard patterns like qwerty, asdfgh, 1qaz2wsx and sequences like abcd or 9876.
- Repeats (aaaa, abcabc) and dates and years, especially birthdays and recent years.
- Common additions: a capital at the start, digits or "!" at the end.
Tips for a strong password
- Use a password manager and let it generate 16+ random characters for every site.
- For passwords you must remember, use a passphrase of 4–6 random words chosen by a generator, not a quote or lyric.
- Never reuse a password: a breach on one site is then tried on all others (credential stuffing).
- Turn on two-factor authentication wherever possible; it protects you even when a password leaks.
Frequently asked questions
Is it safe to type my real password here?
The analysis runs entirely in your browser with JavaScript; the password is never sent over the network, logged or stored. Only the zxcvbn library itself is downloaded. For extra peace of mind you can test a similar password instead of the real one.
What is zxcvbn?
zxcvbn is an open-source password strength estimator created at Dropbox. Instead of counting character types, it searches for patterns attackers try first, such as common passwords, words, names, dates and keyboard patterns, and estimates how many guesses a smart attacker needs.
What do the scores 0 to 4 mean?
0: fewer than 1,000 guesses (too guessable). 1: fewer than a million (very guessable). 2: fewer than 100 million (somewhat guessable, protects against throttled online attacks). 3: fewer than 10 billion (safely unguessable online). 4: 10 billion guesses or more (strong protection even if a slow hash leaks).
Why does P@ssw0rd123! score so low even though it has every character type?
Because cracking tools know the tricks. P@ssw0rd is the word password with predictable substitutions, and 123 and ! are the most common additions. Length and unpredictability matter far more than ticking character boxes.
How are crack times calculated?
The estimated number of guesses is divided by the guessing speed of each scenario: 100 per hour for a throttled online service, 10 per second unthrottled online, 10,000 per second offline against a slow hash such as bcrypt, and 10 billion per second offline against a fast hash such as MD5 or SHA-1 on GPUs.
What makes a strong password?
Length and randomness. Four or more random, unrelated words (a passphrase) or 14+ random characters from a password manager are both excellent. Avoid personal information, common phrases, keyboard patterns and simple substitutions, and never reuse passwords across sites.
What happens if zxcvbn cannot load?
The checker switches to its built-in estimator, which uses the same approach with a smaller dictionary: common passwords, frequent English words and names, l33t speak, sequences, repeats, keyboard rows and dates. The badge above the results always shows which engine was used.