Password Strength Checker
See how long your password would really take to crack. The checker looks for the patterns attackers try first — common passwords, words, keyboard walks, dates — and runs entirely in your browser.
Runs in your browser — nothing is uploaded Free, no limits
Start typing to see how strong your password is.
Need a strong password?
Has this password been leaked? (optional)
Check the password against hundreds of millions of passwords exposed in real data breaches, using the Have I Been Pwned Pwned Passwords service. Your password never leaves this device: it is hashed with SHA-1 here, and only the first 5 of the 40 hex characters are sent. The service returns hundreds of matching hash endings, and the comparison happens in your browser.
How to use the Password Strength Checker
- Type or paste the password into the box (use Show to see what you typed).
- Read the strength rating, entropy estimate and crack times for three attack scenarios.
- Check the weak patterns found and follow the suggestions to improve it.
- Optionally click Check breaches to see whether it appears in known data leaks.
Frequently asked questions
Is it safe to type my password here?
Yes. The analysis runs in JavaScript on your device; the password is never stored, logged or sent to our server. Still, as a habit, prefer testing a password that's similar to yours rather than the real one.
How does the breach check work without sending my password?
It uses Have I Been Pwned's k-anonymity range API. Your password is hashed with SHA-1 in the browser and only the first 5 hex characters of that hash are sent. The service returns every leaked hash starting with those 5 characters (hundreds of them, padded with decoys), and your browser compares the rest locally.
What makes a password strong?
Length and unpredictability. A random passphrase of 4–6 words or a random 16+ character password from a password manager is far stronger than a short word with symbols swapped in, such as P@ssw0rd!.
Why is my password with symbols rated weak?
Cracking tools don't guess randomly — they start with leaked passwords, dictionary words with leetspeak substitutions (a→@, o→0), keyboard patterns, years and a capital letter or ! added at the ends. A password built from these pieces is guessed quickly no matter how many symbol types it contains.
What do the crack-time scenarios mean?
Online attacks guess through a login page, so rate limits slow them to roughly 100 guesses per hour (or 10 per second without limits). Offline attacks run against a stolen database of fast hashes like MD5 at around 10 billion guesses per second on GPUs. The times shown are averages.
What is password entropy?
Entropy, in bits, measures how many guesses a password takes: each bit doubles the work. This tool estimates it the way an attacker would, so patterns reduce it. Around 60 bits is solid for most accounts; 80+ is very strong.