How to use Password strength checker
- Type the password. It's checked on this page as you type.
- Read the strength, the estimated cracking time, and any weak patterns found.
- Optionally, check it against known breaches. Only 5 characters of its hash are sent.
How the estimate works
Attackers don't guess passwords at random. They start with lists of leaked passwords, dictionary words with letters swapped for numbers, keyboard runs such as qwerty, sequences such as 1234, repeated characters and years. The checker looks for each of these patterns, explains any it finds, and discounts them from the password's strength before estimating how long a determined attacker would need.
The cracking time assumes an offline attack on a stolen database at 10 billion guesses a second, which is realistic for fast, unsalted hashes. Well-run sites store passwords with slow hashes that make guessing far slower, but you can't know how a site stores yours, so plan for the worst case and choose a password that holds up even then.
The breach check
A password that has appeared in a data breach is on attackers' lists, however strong it looks. The optional breach check asks Have I Been Pwned, which holds hundreds of millions of breached passwords, without revealing yours: your browser hashes the password with SHA-1 and sends only the first five characters of the hash. The service returns every breached hash that starts with those five characters, several hundred of them, padded with decoys, and your browser looks for an exact match itself. Neither the password nor its full hash leaves this page.
What to do with the result
If a password scores weak or appears in breaches, change it everywhere you've used it, starting with email and banking, and use a different random password for each account. The strength check itself runs entirely in your browser and nothing you type is saved.
Examples
P@ssw0rd2024! looks complex but scores very weak: it's the common password with letters swapped for symbols, plus a year, both of which attackers try early. A random passphrase such as correct-horse-battery-staple-91 scores very strong despite having no capital letters, because its length and randomness outweigh any lack of symbols.
Questions
- Is my password sent anywhere?
- The strength check runs entirely on this page. The breach check is optional; it sends only the first 5 characters of the password's SHA-1 hash to Have I Been Pwned, which returns every breached hash starting with them, and the match is made on your device. The password itself never leaves.
- What makes a password weak?
- Common passwords even with letters swapped for numbers, keyboard runs like qwerty, sequences like 1234, repeated characters, years, and short length. Length matters more than symbols.
- How accurate is the cracking time?
- It's an estimate for an offline attack guessing 10 billion passwords a second, after accounting for the patterns attackers try first. Treat it as a guide, not a guarantee.