Free Password Strength Checker

It uses zxcvbn-ts, a pattern-aware estimator that thinks like a password cracker. It looks for about 49,000 common passwords, common words and names, keyboard runs such as qwerty, sequences, repeats, dates and l33t substitutions, and counts how many guesses an attacker would need. Simply counting letters, digits and symbols misleads: Summer2024! has all four kinds and is still weak.

The check runs in your browser, loads no outside scripts, saves nothing and clears the box after 10 minutes without activity. The only network request the page can make is the optional breach check, and only when you press its button. As a general habit, do not type a password you use into any website you do not trust; if in doubt, test a similar one.

It is the base-2 logarithm of the estimated number of guesses, in bits: each extra bit doubles the work for an attacker. Under 20 bits is very weak, under 36 weak, under 60 fair, under 80 strong and 80 or more very strong. When no known pattern is found in a password of 12 or more characters with three or more kinds of characters, the page rates it as random characters and says so.

They show the same guess count against different attackers: an online login with a limit of about 100 guesses an hour, an online login without a limit at 10 guesses a second, an offline attack on a slow password hash such as bcrypt at 10,000 guesses a second, and an offline attack on a fast hash such as MD5 or SHA-1 at 10 billion guesses a second. The offline cases apply when a site’s database leaks.

It asks the Have I Been Pwned Pwned Passwords service whether your password appears in known data breaches. Your browser makes a SHA-1 hash of the password and sends only its first 5 characters; the service returns every hash that starts the same way, and your browser looks for the rest locally. The password itself is never sent. The check is optional and runs only when you press the button.

Length and randomness, not complicated rules. Current NIST guidance (SP 800-63B) tells services not to force mixtures of character types, and to check passwords against breached lists. A strong password is long (12 or more random characters, or 5 or 6 random words), is not based on personal details, has never appeared in a breach, and is unique to one account.

For passwords stored in a password manager, use 16 or more random characters. For a password you must remember, use a random passphrase of 6 or more words. Use the Generate tab for either, then paste the result into the checker to see its rating.

Yes. A reputable password manager creates and stores a different strong password for every account, so you only need to remember one strong master passphrase. It also removes the pull to reuse passwords, which is how most account takeovers spread.

Only when there is a reason, such as a breach, a sign of compromise or a shared device. Forced periodic changes lead to weaker, predictable passwords. Use a unique strong password for every account and turn on two-factor authentication where it is offered.

They are your own details, such as your name, email name, pet, town or birth year. Attackers try these first, so the checker treats any password that contains them as much weaker. The words stay in the page and are never sent anywhere.