Password strength checker
See how long a password would take to guess. Checked on this page, never sent.
How to use it
- Type or paste the password into the box. Use the eye button to see what you typed.
- Read the strength and the times. Anything under “Strong” is worth replacing.
- Follow the advice under the results, or make a new one with the password generator.
Questions
Is my password sent anywhere?
No. The check runs on this page, in your browser. Nothing is uploaded, saved or logged. Even so, it is a good habit not to type a real password into any site you do not fully trust: type one that is built the same way instead.
How does it estimate strength?
It does not count letters and symbols. It asks how a cracking program would guess the password: common passwords, words, names, keyboard runs, years and repeats first, then plain character combinations. It adds up the guesses along the cheapest way to build the password.
How exact is the estimate?
It is an estimate, not a promise. Its word lists are short, so a password made of rare words can look stronger than it is, and real attackers have lists of billions of leaked passwords. Treat a low result as a clear warning and a high result as a good sign.
What do the times mean?
They assume the attacker is guessing as fast as each situation allows. A website that limits tries is the slowest case. The two “stolen data” cases are what happens after a site leaks stored passwords: a slow method such as bcrypt holds up far better than a fast one such as MD5.
Why is a long password of simple words not listed as very strong?
Several random words are strong, but only when they are truly random. Words that belong together, or a known phrase, are guessed in a few tries. The passphrase generator picks random words for you.
Is anything I enter stored?
No. Calculations happen in your browser and nothing you type is sent or saved.
Is it free?
Yes, you can use it for free. A subscription removes limits and unlocks premium tools.