Password strength checker
Type a password to see how quickly it could be guessed and what makes it weak. It is checked on your device only.
Sealed on this device
Runs in your browser. Nothing is uploaded.
Sealed
Checked on your device. Your password is never sent, stored or logged, and no network request is made while you type.
Start typing to see the result. Tip: test a password that looks like yours rather than your real one, if you prefer.
The checker couldn’t start. Reload the page to try again.
How to improve it
Patterns found
Show the password to see which parts were recognized.
Time to guess it
- Online, with login limits (100 tries per hour)
- —
- Online, without limits (10 tries per second)
- —
- Stolen database, strong protection (10,000 per second)
- —
- Stolen database, weak protection (10 billion per second)
- —
Estimates from the zxcvbn method, which tries the guesses real attackers try first: common passwords, words, names, dates and keyboard patterns.
What it’s made of
- Length
- —
- Lowercase letters
- —
- Capital letters
- —
- Digits
- —
- Symbols
- —
- Spaces
- —
- Other characters (emoji, other scripts)
- —
How it works
-
Type a password
Enter the password you want to test. The check starts with the first character and updates as you type.
-
Read the verdict
See its strength, how long it would take to guess in four attack situations, and the weak patterns found.
-
Make it stronger
Follow the tips, or replace it with a random password or passphrase from our generators.
Frequently asked questions
Is it safe to type my password here?
The check runs entirely in your browser: the password is never sent over the network, saved or logged, and you can verify that no request is made in your browser’s developer tools. If you prefer, test a password built the same way as yours instead of the real one.
How is the strength measured?
With zxcvbn, an open method created at Dropbox. Instead of counting character types, it estimates how many guesses an attacker would need, trying common passwords, dictionary words, names, dates, keyboard patterns and look-alike swaps first.
Why is “P@ssw0rd123!” rated weak?
Because attackers know these tricks. This exact password appears in lists of common passwords, and its recipe, a word with predictable swaps (@ for a, 0 for o), then a number sequence and a symbol, is among the first things they try. It ticks every box of an old-style policy and is still weak.
What do the different attack times mean?
Online attacks go through a login page, which can slow or block repeated tries. Offline attacks happen after a database leak: the attacker tests guesses on their own hardware, slowly if passwords were stored with a strong hashing method, extremely fast if not.
Does it check whether my password was leaked?
No. Checking a leak database would mean contacting an outside service, and this tool never sends anything. It does recognize the most common passwords, which appear in almost every leak.
What makes a password strong?
Length and randomness. A random password of 16 characters, or a passphrase of five or six random words, is far stronger than a short word with symbols added. Use a different one for each account.