How long your password would survive an attack, and exactly what makes it weak
Runs in your browser. Only the lookup you start is sent to api.pwnedpasswords.com; nothing else leaves your device. Updated on 24 Oct 2026.Strength is not about symbols but about how many guesses an attacker would need. This estimates how long yours would survive, names the pattern that weakens it, and shows what adding 4 more characters actually buys. Your password is checked inside the browser.
Type or paste the password into Password to test; press Show if you want to see the characters.
Read the strength meter and the Time to crack card, which estimate how long an attacker would need.
Add your name, email or the site under Words to penalise, so passwords built from them score lower.
Press Check breaches to search the Have I Been Pwned list; only 5 of the 40 hash characters are sent.
Work through the What to fix list, then press Copy report to keep the result.
This password strength checker scores your password from 0 to 4 and tells you how long it would survive four real attacks: guessing against a login with and without throttling, and cracking a stolen hash stored with a slow or a fast algorithm. It names the patterns that make a password weak, such as dictionary words, keyboard runs, dates and repeats, and says what to change.
People use it before setting a master password or a Wi-Fi key, or to show a colleague why Summer2024! is a bad idea even though it ticks every box on a sign-up form. It also catches problems forms ignore: spaces at the ends that some sites trim, and passwords longer than 72 bytes, which bcrypt silently cuts.
Scoring uses zxcvbn-ts with English and common-password dictionaries, running in your browser. The password is never stored, logged or sent. Words you add to the penalty list, such as your name, stay on the page too.
The optional breach check is the only feature on this site that makes a network call with anything derived from what you type, so it is off until you click it. Your browser computes the SHA-1 hash of the password and sends just the first five of its forty characters to Have I Been Pwned. The service returns every leaked hash that begins with those five characters, several hundred of them, and the match happens here. Neither the service nor anyone watching the connection learns the password or even its full hash.
A strong result is not a licence to reuse. Generate a different password per site with the Password Generator and store them in a password manager.
Here, yes. The score is calculated in your browser and the password is never sent, saved or logged. Only the optional breach check contacts another server, and it sends only five characters of a one-way hash, never the password. If you would still rather not, test a password built the same way as yours instead.
zxcvbn estimates how many guesses an attacker who knows common passwords, words, names, dates and keyboard patterns would need. That number is divided by four guess rates: 100 an hour for a throttled login, 10 a second for an unthrottled one, 10,000 a second for a stolen bcrypt hash and 10 billion a second for a stolen MD5 or SHA-1 hash.
The breach check uses k-anonymity. Your browser hashes the password with SHA-1 and sends only the first 5 of the 40 hex characters to Have I Been Pwned. The service replies with every leaked hash starting with those characters, typically 800 to 1,000 of them, and this page looks for yours in that list. The check is off until you click it.
Because attackers try the substitutions people make. P@ssw0rd2024! is a dictionary word with predictable swaps, a year and a symbol at the end, which cracking tools test within seconds. Length and unpredictability matter far more than symbols: four random words beat a short password full of special characters.
A score of 4, very strong, for your email, password manager and banking, since those unlock everything else. Score 3 is acceptable for accounts that throttle login attempts. Anything that scores 0 to 2 can be guessed or cracked quickly once a site is breached, so change it and do not reuse it.
bcrypt, one of the most common ways websites store passwords, reads only the first 72 bytes. Anything after that is ignored, so a longer password gains nothing on those sites. Most characters are one byte, but accented letters take two and Hindi or emoji take three or four, so the limit arrives sooner than the character count suggests.
Still stuck? Ask about Password Strength Checker and anybody who knows can answer. No account needed.
Same job, other tools: OTP Generator – Time-based one-time passwords with 6 or 8 digits and a choice of algorithm · Passphrase Generator – Three to ten random words you can actually remember · Bcrypt Generator – Generate a bcrypt hash for a test user or a config file.
On the related tools: JWT Decoder – Paste a token to read its header, payload and expiry.
In the collection Security Tools for Developers.