Common Password Dictionary Check
Check if a password or a simple variation of it (lowercase, without trailing digits, leetspeak undone) is in a 49,000-entry common password list.
Type a password above to analyze it. Nothing is sent anywhere.
Runs entirely in your browser. Your data is never uploaded.
What is Common Password Dictionary Check?
Attackers start with lists of the most common passwords and their obvious variations. This tool checks your password and its variations against the zxcvbn-ts list of 49,233 common passwords and its English word list, and shows the rank of every match.
How to use Common Password Dictionary Check
- Type the password into the Password field.
- Read the verdict at the top: exact match, match of a variation, or not found.
- Look at the table to see each Variation tried and its rank in Common passwords and English words.
- If anything matches, choose a different password.
Example
Dr@gon2024!
Found as "dragon" (Leetspeak undone). Attackers try these variations first.
"dragon" is rank 10 in the common-password list.
When to use Common Password Dictionary Check
Use it to quickly find out whether a password is based on a well-known password or word. A password that passes is not automatically strong; check its strength and whether it was breached as well.
How Common Password Dictionary Check works
The tool builds candidate strings: the password as typed, lowercase, without leading/trailing digits and symbols, with leetspeak undone (4/@→a, 3→e, 1/!→i or l, 0→o, $/5→s, 7→t…) and reversed. Each candidate is looked up in the zxcvbn-ts common-password list (ordered by frequency, rank 1 = most common) and the English common-words list. Both lists are loaded on demand and checked locally.
Common Use Cases
- Checking a password against a blocklist as NIST SP 800-63B recommends
- Showing users that 'Dr@gon2024!' is just 'dragon'
- Auditing sample passwords in documentation or test data
- Building intuition for how attackers mutate common passwords
FAQs
Which list is used?
The common-password list bundled with zxcvbn-ts (49,233 entries, derived from leaked password corpora) and its 55,830-word English list.
Is this the same as a breach check?
No. This list contains the most common passwords; the breach checker queries Have I Been Pwned's database of over a billion passwords seen in real leaks.
Why match lowercase only?
The lists are lowercase, and cracking tools try capitalized variants of every entry anyway, so capitalization does not make a listed password safe.