Password Strength Checker
See how long a password would hold up against real cracking techniques, with specific fixes for anything weak. Everything runs on your device, so the password you type never leaves your browser.
Check a password
Checked on your device as you type. Nothing is sent, saved, or logged.
Result
Type or paste a password to see how strong it is.
Results are estimates based on known patterns, not a guarantee. This tool can't tell whether a password has appeared in a data breach. If you've used it on another site, change it anyway.
Generate a strong password
Creates a random password on your device using your browser's cryptographic random number generator.
8 to 64 characters. 16 or more is a good default.
Generated password
Choose your options and select Generate password.
How the Password Strength Checker Works
Type or paste a password
The field is a masked password input with a Show/Hide toggle. Autocomplete and spell-check are switched off, so your browser does not suggest, save, or send it to a spelling service.
It is checked against known patterns
The open-source zxcvbn-ts library looks for common passwords, English words and names, keyboard walks like “qwerty”, sequences like “1234”, repeated characters, dates, and look-alike swaps such as “P@ssw0rd”. The word lists load once when the page opens, so typing triggers no network requests.
Read the verdict and crack-time estimates
You get a rating from Very weak to Very strong, an entropy estimate in bits, and how long an attacker would need to guess it at three attack speeds, from a rate-limited login page to a stolen database with a fast hash.
Fix what the checklist flags
Each item is a concrete change, such as “Add 4 more characters to reach at least 12” or “Avoid the common password “password””. If you would rather start fresh, generate a random password below the checker and check it with one click.
Frequently Asked Questions
Is it safe to type my real password into this checker?
The check runs entirely in your browser with JavaScript. The password is never sent in a network request, put in the page URL, saved to local storage or cookies, or included in analytics, and the tool is masked from session recording. The only files the page downloads are the scoring code and word lists, which load before you type. Even so, the safest habit is to test a password that is similar to yours rather than the exact one you use.
How is password strength calculated?
zxcvbn-ts splits the password into the most guessable combination of patterns it can find (dictionary words, common passwords, names, keyboard walks, sequences, repeats, dates) and estimates how many guesses an attacker trying those patterns first would need. That number becomes the 0 to 4 rating, the crack times, and the entropy figure, which is the base-2 logarithm of the guess count. That is why “P@ssw0rd1” rates only Weak even though it mixes four character types.
What do the crack times mean?
They are estimates at three attack speeds. “Slow hash” assumes an attacker has stolen a password database protected with a slow algorithm such as bcrypt and can try 10,000 guesses per second. “Fast hash” assumes a weak, fast hash at 10 billion guesses per second. The third figure assumes a live login page limited to 100 attempts per hour. Real attacks vary, so treat the times as a comparison between passwords, not a guarantee.
Can this tool tell me if my password was in a data breach?
No. It never sends your password anywhere, so it cannot look it up in breach databases. It does flag passwords that appear on common-password lists, but a password can rate Strong here and still have leaked from a site you used. If you have reused a password across sites, change it, and use a password manager to keep a unique one for each account.
How does the password generator work?
It uses your browser’s cryptographic random number generator (crypto.getRandomValues) with rejection sampling, so every character in the pool is equally likely. You choose a length from 8 to 64 characters and which character types to include, and it guarantees at least one character from each type you select. Generated passwords are not stored or sent anywhere; copy one into your password manager before leaving the page.
Related Tools
More Security tools are on the way. Browse all tools.