Password Strength Checker
Test how guessable a password is offline: zxcvbn pattern matching, realistic entropy in bits, crack time for online and offline attacks, and NIST length checks.
The interactive tool loads here when JavaScript runs.
About this toolWhat is the Password Strength Checker?
Type a password and this checker shows how an attacker would actually go about guessing it. It splits the password into the pieces a cracking tool tries first (common passwords, dictionary words, names, keyboard walks such as qwerty, sequences such as abc or 123, repeated characters, dates and recent years, l33t substitutions) and estimates how many guesses it would take to find the whole thing. From that guess count it gives a 0 to 4 score, a realistic entropy figure in bits and the time to crack under four standard attack speeds.
Next to the realistic figure you see the naive entropy that most simple meters report: length multiplied by log2 of the character pool. The gap between the two is the point. P@ssw0rd123 looks like 72 bits by the naive formula because it mixes cases, digits and a symbol, yet it is a near copy of a top-1,000 password and falls in about 10^3 guesses.
Everything runs in your browser with the open-source zxcvbn-ts library and its bundled word lists. The password is not uploaded, logged or stored, and the page sends nothing while you type. Only the score is recorded in anonymous usage statistics.
- zxcvbn-ts pattern matching with English, common-password, name and keyboard lists
- Realistic entropy in bits next to the naive character-pool figure
- Crack time for four standard attack speeds plus your own rate
- Pattern breakdown showing which characters gave the password away
- Personal-word input for targeted-attack scoring
- NIST SP 800-63B-4 length and blocklist checks
- Runs offline in the browser; the password is never sent or logged
How to use the Password Strength Checker
- Type or paste the password. Use the eye button to hide it if someone can see your screen.
- Optionally list words about you (name, username, pet, employer, the site name). A password built from them is scored as a targeted attacker would see it.
- Read the label and score, then compare the realistic entropy with the naive figure.
- Check the crack-time table for the attack that matters: online with rate limiting for a web login, offline slow hash for a well-run site that was breached, offline fast hash for a badly stored one.
- Read the pattern breakdown and suggestions to see which part of the password is weak, then try a longer passphrase and watch the guess count change.
Worked examples
A complex-looking common password
Input
P@ssw0rd123
Output
Weak (1 of 4), about 10^3.2 guesses, 10.6 bits realistic vs 72.3 bits naive
zxcvbn recognises "password" with l33t substitutions and a common suffix, close to a ranked entry in its password list. The symbols add almost nothing.
The famous xkcd comparison
Input
Tr0ub4dor&3 versus correct horse battery staple
Output
Weak (1), 10^5.9 guesses versus Very strong (4), 10^20.2 guesses
Four ordinary words separated by spaces beat one disguised word by about fourteen orders of magnitude, because length multiplies guesses and substitutions barely do.
A random 16-character string
Input
kX9#mQ2$vL7!pR4&
Output
Very strong (4), 10^16 guesses, about 12 days at 10 billion guesses per second
No patterns are found, so zxcvbn falls back to brute force. Even so, a fast unsalted hash leaves it within reach of a large rig, which is why storage matters.
A name and a birth year
Input
johnsmith1985 with "john, smith" as personal words
Output
Fair (2), about 10^6.5 guesses
The common-password list already contains johnsmith, and 1985 is matched as a recent year. Personal words make such passwords even cheaper to guess.
Background and insight
The estimator is zxcvbn, designed by Daniel Lowe Wheeler at Dropbox and described in his 2016 USENIX Security paper "zxcvbn: Low-Budget Password Strength Estimation". Instead of counting character classes it matches the password against ranked word lists, keyboard adjacency graphs, sequences, repeats and date formats, then finds the combination of matches that needs the fewest total guesses. The paper showed this tracks real cracking results far better than composition rules do. This page uses zxcvbn-ts 3, a maintained TypeScript port whose lists hold about 49,000 leaked passwords, common English words, Wikipedia words, first names and surnames, with keyboard graphs for QWERTY, QWERTZ, AZERTY, Dvorak and numeric keypads.
The score bands come from that guess count: 0 below 10^3 guesses, 1 below 10^6, 2 below 10^8, 3 below 10^10 and 4 above. The crack-time rows divide the guesses by a rate: 100 per hour for an online login with rate limiting, 10 per second without it, 10,000 per second for an offline attack on a slow hash such as bcrypt, and 10 billion per second for an offline attack on a fast unsalted hash. You can add your own rate for a specific threat.
The NIST checks follow SP 800-63B-4 (2025), section 3.1.1.2. Verifiers must require at least 15 characters when a password is the only authenticator and at least 8 when it is one factor of several, should accept at least 64 characters, must compare new passwords against a blocklist of common or compromised values, and must not impose composition rules or periodic changes. The blocklist check here uses zxcvbn's common-password list, which is smaller than a breach corpus such as Have I Been Pwned.
Common use cases
Choosing a master password
Check a password-manager or disk-encryption passphrase against offline attack speeds before you commit it to memory.
Explaining password policy
Show colleagues why length beats symbols and why NIST dropped composition rules, using live numbers.
Testing a sign-up meter
Compare the score your own site shows with zxcvbn's estimate for the same inputs.
Security awareness training
Demonstrate how keyboard walks, years and l33t substitutions collapse the guess count.
Tips and limitations
- Do not paste a password you use today into any website you have not checked. This page works offline, but the safer habit is to test a similar pattern rather than the real value.
- Crack times are estimates for the guess count zxcvbn finds. A determined attacker with your personal details, or a password reused from a breach, can do far better.
- A password that already appears in a breach is weak whatever its score. Check it against Have I Been Pwned's Pwned Passwords service separately.
- Word lists are English-centric. Common words in other languages may be scored as random characters and overrated.
- zxcvbn analyses the first 256 characters. Anything longer is already far beyond practical guessing.
- The fix for almost every weak result is the same: more length, ideally four or more random words, or a generated password stored in a password manager.
Frequently asked questions
How is password entropy calculated?
The simple formula is length × log2(pool size), where the pool is 26 for lowercase only, 62 for letters and digits, or about 95 for all printable ASCII. That assumes every character was chosen at random. This checker also reports log2 of zxcvbn's estimated guesses, which accounts for words and patterns and is usually much lower.
What does a zxcvbn score of 3 mean?
The estimated guess count is between 10^8 and 10^10. zxcvbn describes that band as safely unguessable against an offline attack on a salted, slow hash such as bcrypt, but not against a fast hash. Score 4 means more than 10^10 guesses.
Is a 12-character password secure?
It depends on what the characters are. Twelve random characters from all printable ASCII give about 79 bits and are very strong. Twelve characters made of a word, a capital and a year can fall in a few thousand guesses. NIST now asks for 15 characters when the password is the only factor.
Do symbols and capital letters make a password stronger?
Only when they are placed unpredictably. A capital first letter and a symbol or digit at the end are the first things cracking rules try, so they add very little. Adding another random word adds far more.
Why does my password score differently on other sites?
Many meters only count length and character classes, so they rate P@ssw0rd123 as strong. Others use zxcvbn with different word lists or thresholds. The numbers here come from zxcvbn-ts 3 with its English and common lists.
Does this tool send my password anywhere?
No. The analysis and the word lists run in your browser. There is no breach lookup, which would require a network request; use Have I Been Pwned for that, which only receives the first five characters of the SHA-1 hash.
How realistic are the crack times?
They are guesses divided by an assumed speed. A modern GPU rig can try well over 10 billion fast hashes per second, while bcrypt at a sensible cost allows only thousands. Treat the table as an order-of-magnitude guide, not a promise.
Is there an in-depth guide to the Password Strength Checker?
Yes. “Password Strength and Entropy: What Crack-Time Estimates Mean” covers the background, how it works, common pitfalls and worked examples. Read the full guide.
People also search for
- how long would it take to crack my password
- is my password strong enough offline check
- password entropy bits calculator
- is a 12 character password secure
- does adding a symbol make a password stronger
- nist password length requirements 2025
- correct horse battery staple strength
- zxcvbn password score meaning
Related Tools You May Like
Free, in-browser tools that pair well with this one.