Simple rules like “one capital and one number” do not make a password strong: Summer2024! follows them and is still guessed quickly. This checker uses zxcvbn, the open-source estimator built by Dropbox, which knows common passwords, names, dictionary words, dates, keyboard patterns like qwerty and swaps like p@ssw0rd, and estimates how long real attackers would need to crack it.
loading toolHow to check a password’s strength
- Type a password into the box.
- Read the strength, crack time estimates and the patterns found.
- Follow the suggestions until it shows Strong or Very strong.
Good to know
- Never reuse a password on two sites: one leak then opens both.
- Turn on two-step verification for email and banking, whatever your password.
Questions
Is it safe to type my real password here?
The check runs entirely in your browser and the password is never sent, saved or logged. If you prefer, test a password that follows the same pattern instead.
What makes a password strong?
Length and unpredictability. Four or five random words (like “velvet-rocket-mango-quiet”) are both strong and easy to remember. A password manager can create and remember random ones for you.
What do the crack times mean?
They assume an attacker who stole a site’s password database. A well-protected site slows guessing a lot; a badly protected one lets attackers try billions of guesses per second.
Is my data private?
Yes. Everything happens inside your own browser: nothing you type or choose is uploaded to us or anyone else.
Is it free?
Completely free, with no sign-up, no watermark and no limit on how many times you use it. Light ads keep the site running.
