Password Predictability Checker
Detect predictable human habits in a password, like capital first letter plus year and '!', seasons, keyboard walks and leetspeak, with hashcat mask.
Type a password above to analyze it. Nothing is sent anywhere.
Runs entirely in your browser. Your data is never uploaded.
What is Password Predictability Checker?
People follow the same habits when they create passwords: a capitalised word, then a year, then an exclamation mark. This checker lists those habits in your password, shows its hashcat mask and structure, and gives an overall predictability verdict.
How to use Password Predictability Checker
- Enter a password in the Password field.
- Read the verdict: highly predictable, somewhat predictable or no common human patterns.
- Check the hashcat mask and Structure values.
- Go through the list of detected habits and avoid them in your next password.
Example
Summer2024!
Highly predictable – mask ?u?l?l?l?l?l?d?d?d?d?s, structure U L5 D4 S; habits: classic structure, only first letter capitalized, digits at the end, symbol at the end, contains a year, contains a season, shorter than 12 characters
When to use Password Predictability Checker
Use it to see why a password that meets complexity rules is still weak, or to explain cracking rules to users. It does not estimate crack time; pair it with the strength checker.
How Password Predictability Checker works
Rules check for: letters followed by digits and optional symbols; only the first letter capitalized; trailing digits; trailing symbols; years 1950–2049; season and month names; leetspeak digits/symbols inside words; keyboard walks of 4+ keys on QWERTY, QWERTZ, AZERTY and column walks; alphabetical or numeric runs of 4+; repeated characters or blocks; a single character class; length under 12. The verdict counts the habit rules (excluding length and single class): 3+ = highly predictable, 1–2 = somewhat predictable. The mask uses hashcat notation (?u upper, ?l lower, ?d digit, ?s symbol).
Common Use Cases
- Explaining why 'Summer2024!' passes complexity rules but is weak
- Security awareness training about cracking rules
- Reviewing password examples in internal policies
- Understanding hashcat masks
FAQs
What is a hashcat mask?
A template for brute-force attacks: ?u?l?l?l?l?l?d?d?d?d?s means one uppercase letter, five lowercase, four digits and a symbol. Attackers run the most common masks first.
Why are seasons and years flagged?
Forced periodic password changes lead to passwords like Spring2025!, Summer2025!, which cracking rules generate automatically.
My password has no detected habits. Is it strong?
Not necessarily; it may still be short or a dictionary word. Check it with the strength checker too.