About Password Strength Checker
Many strength meters count character types, so P@ssw0rd! scores well because it has a capital, a digit and a symbol. Attackers do not guess like that. They start with lists of common passwords, words, keyboard runs and dates, and they know every common letter swap. This checker estimates the work from that point of view, so P@ssw0rd! comes out as very weak.
You see a rating, then the reasons: how the password splits into parts, what each part is, and how long different attacks might take. The check runs in your browser. Nothing you type is sent or saved. When we recorded the page's network traffic while typing into the box, there were no requests at all. Even so, it is wise to test something similar to your password, not the real one.
How it works
The password is broken into its cheapest explanation, an approach based on the zxcvbn paper from USENIX Security 2016, with a smaller word list. The code looks for common passwords, English words, keyboard runs, repeated blocks, sequences such as abc, and years and dates. It undoes letter swaps such as 0 for o. It also looks for text that reads like a word, even if it is not on the list. Anything left over is priced as brute force. A shortest-path search then finds the split that needs the fewest guesses in total, and that figure gives the bits shown.
Ratings follow from the bits: under 20 is very weak, under 35 weak, under 50 fair, under 70 strong, and 70 or more very strong. Times are the average case, half the guesses, at four attack speeds: 100 guesses an hour for a rate-limited login, 10 a second with no limit, 10 thousand a second against a slow hash such as bcrypt, and 10 billion a second against a fast hash such as MD5. A comparison line shows what a meter that only counts character types would have claimed.
How to use Password Strength Checker
- Type in Password to test, or press one of the examples. Press Show to see what you typed.
- Read the rating and the estimated bits of entropy.
- Look at What it is made of for the parts and any advice below them.
- Compare the rows under How long an attacker might need.
Real runs on the page's examples
Summer2024!
Tr0ub4dor&3
correct horse battery stapleSummer2024!: Weak, about 23 bits. Fast hash: instantly. Parts: common password, date, 1 random character.
Tr0ub4dor&3: Fair, about 47 bits. Fast hash: 2 hours. Parts: word-like text, 2 random characters.
correct horse battery staple: Strong, about 56 bits. Fast hash: 1 month. Parts: 4 words with separators.For Summer2024!, a meter counting character types would claim 72 bits, and patterns take away 49 of them. The long, plain phrase beats the short clever one by a wide margin.
When it helps
- Seeing why a password you thought was clever is not
- Teaching a team or family why length and randomness beat symbols
- Comparing two password styles or a company policy against real guessing methods
Tips for a better result
- Use a password manager and let it generate a long random password for each account. Reuse is a bigger danger than weak characters, since one leak then opens every account.
- For the few you must remember, use four or more random unrelated words. Pick them with a Password Generator or dice, as phrases you think of yourself are more predictable.
- Turn on two-factor sign-in wherever it is offered. It protects you even if the password leaks.
- Read the slow hash and fast hash rows as a range. You rarely know how a website stores your password, so plan for the worse case.
Good to know
- It cannot check whether your password has appeared in a data breach, because that would mean a lookup outside your device. A strong-looking password that has leaked is not safe.
- The word list is English and fairly short, so words in other languages and names may look stronger than they are. Well-known phrases are not on any list here either: the example phrase above scores well, even though it is famous and should not be used.
- This is an estimate of guessing effort, not a guarantee. Phishing, malware and reused passwords get around strength entirely.
- It knows nothing about you. A pet's name or a street name looks like random text here, but it is easy for someone who knows you.
Questions people ask
Is my password sent anywhere?
No. All the analysis is in code that has already loaded, and there is no network request as you type. The box also turns off autocomplete, and the value is not saved. Testing a similar password is still the safest habit.
Why is P@ssw0rd! rated very weak?
It is a known password with routine letter swaps, and swaps are tried automatically. It comes out at about 12 bits, though a simple meter would claim 59. Three character types do not help when the base word is on every list.
What do bits mean here?
Bits are a way of counting guesses: each extra bit doubles them. So 40 bits is about a trillion guesses, and 50 bits is about a thousand times that. Bits here estimate real guessing, not the size of the alphabet.
What to use next
- Password Generator: to make a long random replacement
- Hash Generator: to see what a fast hash such as SHA-256 looks like
- HMAC Generator: for signing messages with a secret key
Last reviewed . Read our editorial policy.