Password strength checker

How to use this tool

1. Type or paste the password. It stays hidden unless you tick Show password.
2. Add words an attacker might know about you, such as your name, if you like.
3. Read the score, the crack-time estimates and the warnings.
4. Follow the suggestions, or create a new one with the password generator.

How it works

Attackers do not try every combination in order. They start with leaked password lists, dictionary words with capitals and number swaps, names, dates, keyboard runs such as qwerty and sequences such as 1234. The checker works the same way: it splits your password into the parts an attacker would guess first, estimates the guesses each part needs, and adds brute force only for the truly random parts.

The score runs from 0 (very weak) to 4 (very strong). Crack times are shown for four cases, from a website that limits login attempts to an offline attack on a stolen database with a fast hash. The word list includes the EFF Large Wordlist (CC BY 3.0 US) and a list of the most common passwords.

Good to know

Length beats complexity. A random 16-character password, or a passphrase of five or six random words, is far stronger than a short password with a capital letter and a symbol at the end. Predictable tricks, like @ for a or a year at the end, are among the first things cracking tools try.

The most important rule is to use a different password for every account, so one leak does not unlock the others. A password manager makes that easy. Turn on two-step verification for email, banking and social accounts. This checker is an estimate: it cannot know whether your password has already appeared in a breach, and it never checks online, so nothing you type here leaves the page.