How to use it
- 1Type or paste a password into the box. Click the eye icon to see what you typed.
- 2Read the rating and the three crack-time estimates. They update as you type.
- 3Follow the tips under the rating to fix weak spots such as dictionary words, names, dates or keyboard patterns.
- 4Click “Check if this password has leaked” to find out whether it appears in known data breaches.
How the strength is estimated
The checker uses zxcvbn, an open-source strength estimator first built at Dropbox, in its TypeScript edition. Instead of counting character types, it looks for the patterns cracking tools try first: common passwords, dictionary words, names, dates, repeated characters, sequences like abc123, keyboard walks like qwerty and look-alike swaps like p@ssw0rd. From the patterns it finds, it estimates how many guesses an attacker would need.
That is why the rating often differs from typical password rules. Qwerty123! has a capital letter, a number and a symbol, yet it’s rated very weak because it’s a keyboard walk with a common ending. Four random everyday words, such as maple tractor lantern pebble, contain nothing but lowercase letters and are rated very strong.
What the crack times mean
How fast a password falls depends on where the attacker guesses. Against a live login page that limits attempts, about 100 guesses an hour is realistic. If a site’s password database leaks, the attacker can guess offline at full speed: around 10,000 guesses a second when the passwords are stored with a deliberately slow hash such as bcrypt, scrypt or Argon2, and 10 billion or more when a fast hash like MD5 or SHA-1 is cracked on graphics cards.
You rarely know how a site stores your password, so aim for one that holds up even in the fast-hash column – and use it for one account only, so a breach elsewhere can’t expose it.
How the leak check keeps your password private
The leak check uses Pwned Passwords from Have I Been Pwned, a free database of hundreds of millions of passwords exposed in data breaches. Your browser calculates the SHA-1 hash of the password and sends only its first five characters. The service replies with every leaked hash that starts with those characters – usually several hundred – plus random padding, and the comparison happens on your device.
This approach, called k-anonymity, means neither the password nor its full hash leaves your browser, and the service can’t tell which of the returned hashes you were looking for. The check only runs when you click the button; everything else on this page works offline.
Questions and answers
Is it safe to type my real password here?
The strength check runs entirely in your browser, and nothing you type is sent anywhere or stored. The optional leak check sends only the first five characters of the password’s SHA-1 hash, which can’t be turned back into the password. If you’d rather be extra careful, test a password built the same way as yours instead of the exact one.
What makes a password strong?
Length and unpredictability. A long string of random characters, or a passphrase of four or more randomly chosen words, has no pattern for cracking tools to exploit. Avoid names, dates, single words with letters swapped for symbols, and anything you’ve used before.
Why is my password rated weak even though it has symbols and numbers?
Cracking tools know the usual tricks – a capital first letter, a number or year at the end, @ instead of a – and try them early. A password like Summer2024! meets most password rules but falls in a fraction of a second if a database leaks. More length or more random words helps far more than extra symbols.
What should I do if my password was found in a data breach?
Stop using it, and change it on every account where you’ve used it, starting with email and banking. Replace it with a unique password from a generator, keep it in a password manager, and turn on two-factor authentication wherever you can.
How accurate are the crack times?
They are estimates. The real time depends on the attacker’s hardware and on how the site stores passwords, which you usually can’t know. Use them to compare: a password that would take centuries even in the fast-hash scenario is safe, one that falls within minutes is not.