Password Strength Checker
Password & SecurityProcessed locally in your browser using the Web Crypto API. Nothing is sent to any server.
How It Works
The Password Strength Checker uses the zxcvbn algorithm, originally developed by Dropbox. Unlike simple length-based checkers, zxcvbn performs pattern recognition to estimate how many guesses an attacker would need to crack your password.
How It Works
- Pattern detection: Recognizes dictionary words, keyboard patterns (e.g., "qwerty"), repeated characters, dates, and common substitutions (e.g., @ → a, 3 → e)
- Common password database: Checks against the top 10,000 most common passwords and names
- Entropy estimation: Calculates the unpredictability of your password in bits — each additional bit doubles the search space
- Crack time model: Assumes an attacker can make 10¹² guesses/second (one trillion — representing modern GPU clusters)
- Score: Rates your password from 0 (very weak) to 4 (very strong) based on zxcvbn's heuristics
How to Create a Strong Password
- Length matters most: Use at least 12 characters; 16+ is ideal. Each character exponentially increases crack time.
- Mix character types: Combine uppercase, lowercase, numbers, and symbols. All four types together maximize entropy.
- Avoid common patterns: Don't use dictionary words, keyboard sequences ("qwerty"), or personal info (birthdays, names).
- Consider passphrases: A random phrase like "correct horse battery staple" is both strong and memorable. Spaces are allowed here.
- Use unique passwords: Never reuse passwords across accounts. A password manager helps generate and store unique passwords.
Understanding the Results
- Entropy (bits): Mathematical unpredictability. 60+ bits is generally considered strong.
- Time to crack: Estimated time at 10¹² guesses/sec. A password with 60+ bits would take centuries to crack.
- Feedback: Specific suggestions to improve your password (e.g., "Add another word", "Avoid repeated characters")
Frequently Asked Questions
Is my password sent to a server?
No. All analysis happens entirely in your browser. Your password never leaves your device.
What makes a password strong?
Length (12+ characters), mixed character types (uppercase, lowercase, numbers, symbols), and no common patterns or dictionary words. Each additional character exponentially increases crack time.
How often should I change my password?
Only if compromised. Security experts no longer recommend frequent password changes, as they lead to weaker, predictable passwords. Instead, use unique passwords per account and enable two-factor authentication.
Is a password manager safe?
Yes. Reputable password managers use strong encryption (AES-256) and zero-knowledge architecture. They generate and store unique passwords so you only need to remember one master password.
What is a passphrase?
A passphrase is a random phrase like "correct horse battery staple" — easier to remember than a random password, but equally strong or stronger due to its length. This tool accepts passphrases with spaces.
Privacy Note
This tool runs entirely in your browser. Your input is never uploaded, stored, or sent to any server.
Disclaimer: This tool is provided for educational and informational purposes only. The results do not constitute professional security advice. Use at your own discretion.