How is password strength measured?

By estimating how many guesses an attacker would need, not by ticking boxes for symbols and capitals. Attackers try the likeliest passwords first: leaked common passwords, words with capitals and look-alike swaps, keyboard runs, dates. This checker, modelled on the open-source zxcvbn estimator, splits your password into such patterns, estimates the guesses each one needs, and finds the cheapest combination. The guesses become a 0–4 score and crack times at three attack speeds. It is an estimate: a real attacker may know more about you.

Is it safe to type my password into a strength checker?

This one never sends it anywhere: the check runs on your device, nothing is submitted or stored, and analytics only record that the checker was used. Once the page has loaded it works offline. Still, it is good practice not to type a real, current password into any website: check a similar one, or check a new password before you start using it.

Why is P@ssw0rd rated weak when it has symbols and numbers?

Because swapping letters for look-alikes (@ for a, 0 for o), capitalising the first letter and adding a year are exactly the variations cracking tools try first. P@ssw0rd2024 is “password” plus the most predictable changes, so it falls almost at once even though it meets typical “one capital, one number, one symbol” rules.

What makes a password strong?

Randomness and length. A random password of 16 or more characters, or a passphrase of 5 or more random words, is strong for any online account. Avoid anything about you (names, birthdays, pets), and use a different password for every account, kept in a password manager.

How long would it take to crack my password?

It depends on how the attacker gets to guess. A login page that limits attempts slows guessing to a crawl, so even a weak password can last a while there. The danger is a stolen database, where attackers guess offline as fast as their hardware and the site’s hashing allow: from about 10,000 guesses a second against slow hashes such as bcrypt to billions against fast ones. The checker shows all three cases.

Does this check whether my password has been leaked?

No. That would need a database of leaked passwords, and looking yours up would mean sending something derived from it off your device, which this page never does. It does recognise 350 of the most common leaked passwords. If you think a password has leaked, change it, and do not reuse it anywhere.

Password Strength Checker: How Strong Is My Password?

Type a password to see how guessable it is: a score from 0 to 4, how long it would take to crack online and offline, the patterns that weaken it (common passwords, words, keyboard runs, years) and how to fix them. It runs entirely in your browser and the password is never sent or saved. The example below, P@ssw0rd2024, scores 0 of 4 (very weak): it is a top-10 password with look-alike swaps and a year added.

Updated 2026-09-28Runs in your browser: nothing you enter is uploadedHow this tool works

Password to checkNever leaves your device

Type or paste a password. It is checked on this device as you type and is never sent, saved or logged.

Show password

Showing the result for the example P@ssw0rd2024. Replace it with the password you want to check.

Strength: Very weak (0 of 4)

about 15,000 guesses · about 14 bits

It is built on one of the 10 most common passwords.

Time to crack it

Online, rate-limited (100 guesses an hour): 6 days
Stolen database, slow hash such as bcrypt (10,000 a second): 2 seconds
Stolen database, fast hash such as unsalted SHA-1 (10 billion a second): less than a second

What the checker found

Common password · 8 characters · #2 on the checker’s list · look-alike swaps undone · capital first letter · about 50 guesses
Year · 4 characters · about 50 guesses

How to make it stronger

Make it longer: 15 or more characters, or 5 or more random words, adds far more strength than symbols do.
Swapping letters for look-alikes (@ for a, 0 for o) does not fool cracking tools: they try those first.
A capital first letter barely helps: it is the first variation tried.
Leave out years and dates, especially ones linked to you.
Let a password manager or the generator on this site pick it at random: people pick patterns without meaning to.

An estimate, not a guarantee: it knows common patterns, not what an attacker may know about you. Only the first 128 characters are analysed.

What the scores mean

Crack times are for the top of each band. Scores are stricter than a login page needs, so that a “Strong” password also survives a stolen, quickly hashed database.
Score	Estimated guesses	Online, rate-limited	Stolen database, fast hash	Typical examples
0: Very weak	fewer than 1 million	1 year	less than a second	password123, qwerty, P@ssw0rd2024
1: Weak	1 million to 10 billion	11 thousand years	1 second	Monkey!2023, Tr0ub4dor&3
2: Fair	10 billion to 100 trillion	114 million years	3 hours	tiger maple orbit canvas (4 random words)
3: Good	100 trillion to 1 quintillion	longer than the universe has existed	3 years	8 random letters, numbers and symbols
4: Strong	more than 1 quintillion	longer than the universe has existed	more than 3 years	16 or more random characters, or 6 random words

Attack speeds behind the crack times

Scenario	Guesses	When it applies
Online, rate-limited	100 an hour	Someone guessing at a login page that locks or slows down after failed attempts. NIST tells sites to allow no more than 100 failed attempts in a row.
Stolen database, slow hash	10,000 a second	A leaked password database protected with a deliberately slow hash such as bcrypt, scrypt or Argon2.
Stolen database, fast hash	10 billion a second	A leaked database with a fast or unsalted hash such as MD5 or SHA-1, attacked with graphics cards. Plan for this one: you cannot see how a site stores passwords.

How to check and improve a password

Type or paste it. Enter the password in the box, replacing the example. Tick Show password to check for typos; nothing leaves this device.
Read the score and crack times. The score runs from 0 (very weak) to 4 (strong). “Online” is someone guessing at a login page; “stolen database” is what happens after a site is breached.
Fix what it flags. Each pattern it found (a common password, a word, a keyboard run, a year) comes with advice. Length and randomness fix almost everything.
Use a new, random one. For any password scoring below 3, switch to a random password or a passphrase of 5 or more random words from the password generator, and store it in a password manager.

Frequently asked questions

How is password strength measured?: By estimating how many guesses an attacker would need, not by ticking boxes for symbols and capitals. Attackers try the likeliest passwords first: leaked common passwords, words with capitals and look-alike swaps, keyboard runs, dates. This checker, modelled on the open-source zxcvbn estimator, splits your password into such patterns, estimates the guesses each one needs, and finds the cheapest combination. The guesses become a 0–4 score and crack times at three attack speeds. It is an estimate: a real attacker may know more about you.
Is it safe to type my password into a strength checker?: This one never sends it anywhere: the check runs on your device, nothing is submitted or stored, and analytics only record that the checker was used. Once the page has loaded it works offline. Still, it is good practice not to type a real, current password into any website: check a similar one, or check a new password before you start using it.
Why is P@ssw0rd rated weak when it has symbols and numbers?: Because swapping letters for look-alikes (@ for a, 0 for o), capitalising the first letter and adding a year are exactly the variations cracking tools try first. P@ssw0rd2024 is “password” plus the most predictable changes, so it falls almost at once even though it meets typical “one capital, one number, one symbol” rules.
What makes a password strong?: Randomness and length. A random password of 16 or more characters, or a passphrase of 5 or more random words, is strong for any online account. Avoid anything about you (names, birthdays, pets), and use a different password for every account, kept in a password manager.
How long would it take to crack my password?: It depends on how the attacker gets to guess. A login page that limits attempts slows guessing to a crawl, so even a weak password can last a while there. The danger is a stolen database, where attackers guess offline as fast as their hardware and the site’s hashing allow: from about 10,000 guesses a second against slow hashes such as bcrypt to billions against fast ones. The checker shows all three cases.
Does this check whether my password has been leaked?: No. That would need a database of leaked passwords, and looking yours up would mean sending something derived from it off your device, which this page never does. It does recognise 350 of the most common leaked passwords. If you think a password has leaked, change it, and do not reuse it anywhere.

How it works

The estimate follows the approach of zxcvbn (Wheeler, 2016) with a much smaller built-in dictionary. The password is scanned for patterns: 350 of the most common leaked passwords (earlier on the list means fewer guesses), 2,048 common English words, and any letter run that reads like a word (counted as one of 50,000), each also reversed, capitalised or with look-alike swaps undone; words joined by one separator (a passphrase, counted the way the password generator counts it); sequences such as abcd or 9876; keyboard walks on a US QWERTY layout such as qwerty or 1qaz; repeats such as aaa or abcabc; years and dates. Anything else counts as random characters, at 26, 52, 62 or 95 possibilities per character depending on the character types in that stretch. The checker then finds the split of the whole password with the fewest total guesses, allowing for the order of the parts. Scores: under 10^6 guesses is 0, under 10^10 is 1, under 10^14 is 2, under 10^18 is 3, and 4 above that. These are stricter than zxcvbn’s own (10^3 to 10^10) because they are meant to hold against a stolen database, not only a login page. Crack times divide the guesses by 100 an hour, 10,000 a second or 10 billion a second. Only the first 128 characters are analysed. The password never leaves your browser.

Sources

All tools Home & DIY calculators