Password Strength Checker
See how long a password would take to guess, from online guessing to a data breach, what makes it weak, and how to make it stronger. It’s checked on your device and never sent anywhere.
Last updated
🔒 What you type here never leaves this device. It all happens in your browser, which is told to block this page from sending anything to other websites. Try it with airplane mode on: it still works. Check for yourself
Sent to other websites from this page: 0
🔒 Checked on this device. What you type isn’t sent or saved anywhere.
| Someone guessing online, slowed down by the site100 guesses an hour | |
|---|---|
| Someone guessing online, not slowed down10 guesses a second | |
| After a data breach, if the site stored it well10,000 guesses a second (bcrypt, scrypt, Argon2) | |
| After a data breach, if the site stored it badly10 billion guesses a second (fast hashes, many computers) |
How it would be guessed
Add your own details to check against (optional)
Passwords built from these are easy for someone who knows you to guess. They stay on this device too.
Optional. Asks Have I Been Pwned whether this password is among those leaked in data breaches. Only the first 5 characters of a scrambled fingerprint (SHA-1 hash) of it are sent: never the password, and not enough to work it out. The answer is worked out here.
How to check a password’s strength
- Type or paste the password. It’s rated as you type.
- Read how long it would take to guess in each situation, and the advice for making it stronger.
- Optionally, add your own details (name, birthday, pet) to see if it’s built from them, or check whether it’s appeared in a data breach.
About this tool
Rating a password by its length and whether it has a capital letter, a number and a symbol is misleading: “Password1!” passes those rules and is one of the first things anyone tries. This checker uses zxcvbn, the estimator Dropbox built and published, which thinks like someone guessing. It looks for common passwords, words, names, keyboard patterns like “qwerty”, sequences, repeats, dates and look-alike swaps (“p@ssw0rd”), and counts how many guesses the cheapest way to break it would take.
Those guesses become times for four situations: someone trying to log in to a site that slows them down; one that doesn’t; and after a data breach, where the attacker has the site’s stored copies and can guess as fast as their computers allow, which depends on whether the site stored passwords with a slow hash (as it should) or a fast one.
Everything happens in your browser: the password isn’t sent anywhere or kept. The leak check is optional and only runs if you click it; it uses Have I Been Pwned’s range search, which is designed so that the password can’t be worked out from what’s sent.
Questions about password strength
Is it safe to type my real password here?
Yes: it’s checked on your device and not sent or stored, and the page has no ads or trackers. You can prove it: switch on airplane mode and it still works, or watch the live request counter at the bottom of the page. Even so, a sensible habit is to check a password like yours rather than the real one.
What makes a password strong?
Length and unpredictability. Four or five random words (“correct horse battery staple”) or 14+ random characters are far stronger than a short word with symbols swapped in. Our passphrase generator and password generator make them for you.
Why is “P@ssw0rd123!” rated weak when it has everything?
Because guessers know that trick. It’s a common word with predictable swaps and a number on the end, so it’s tried very early, whatever the character rules say.
What does the leak check send?
Only the first 5 characters of the SHA-1 hash of your password. Have I Been Pwned replies with every leaked hash starting with those 5 characters (hundreds of them, padded so the reply size gives nothing away), and this page looks for yours in that list. Your password, and even its full hash, never leave your device.
Should I use the same strong password everywhere?
No. If one site is breached, the same password unlocks the others. Use a different one for each site; a password manager remembers them for you.