Password Strength Checker
Check password strength with zxcvbn-ts: score 0–4, estimated guesses, crack times for four attack scenarios and concrete tips. Nothing is uploaded.
Type a password above to analyze it. Nothing is sent anywhere.
Runs entirely in your browser. Your data is never uploaded.
What is Password Strength Checker?
This checker estimates how hard a password is to guess using zxcvbn-ts, the maintained TypeScript port of Dropbox's zxcvbn. Instead of counting character types, it looks for dictionary words, names, keyboard patterns, dates and repeats, then shows a 0–4 score, estimated guesses, crack times and advice.
How to use Password Strength Checker
- Type or paste a password into the Password field (use Show to see it).
- Read the strength label and zxcvbn score.
- Compare the crack times for online and offline attacks.
- Follow the warning and suggestions to improve the password.
Example
Tr0ub4dor&3
Weak – zxcvbn score 1/4, 10^5.9 guesses, about 1 minute against a slow-hash offline attack. Warning: Single words are easy to guess.
When to use Password Strength Checker
Use it to evaluate a password you made up or to explain to users why 'P@ssw0rd!' is weak. It cannot know whether a password was leaked; use the breach checker for that. Do not paste passwords you currently use on shared or untrusted computers.
How Password Strength Checker works
zxcvbn-ts matches the password against common-password, English word, name and Wikipedia lists (with leetspeak and reversed variants), keyboard adjacency graphs, sequences, repeats and dates, then finds the combination of patterns that needs the fewest guesses. Score thresholds: <10^3 guesses = 0, <10^6 = 1, <10^8 = 2, <10^10 = 3, otherwise 4. Crack times divide the guesses by 100/hour (throttled online), 10/s (unthrottled online), 10^4/s (slow hash like bcrypt) and 10^10/s (fast hash like MD5). The dictionaries load only when you first type.
Common Use Cases
- Checking a self-chosen password before using it
- Showing colleagues why common substitutions do not help
- Comparing a passphrase against a complex short password
- Teaching password security in training sessions
Security Note
A high score is an estimate, not a guarantee. A password that was leaked anywhere should never be reused, whatever its score.
FAQs
Why is Tr0ub4dor&3 rated weak?
zxcvbn recognises it as a dictionary word with predictable leetspeak substitutions, so only about 10^6 guesses are needed despite the symbols and digits.
What do the four crack times mean?
They cover an online attack with rate limiting, an online attack without limits, and offline attacks against a slow (bcrypt-like) or fast (MD5-like) password hash after a database leak.
Is my password sent anywhere?
No. The analysis runs in your browser; only the dictionaries are downloaded from this site.
What score should I aim for?
Score 4 (more than 10^10 guesses) for anything important. Long random passphrases reach it easily.