Password Strength Checker
Find out how long your password would take to crack, and what makes it weak. The check runs in your browser and the password is never sent anywhere.
Your password
Checked on your device. Nothing you type is sent or saved.
Result
Type a password to see how strong it is.
Make it stronger
- Length beats symbols. 16 random characters or 6 random words is a good target.
- Never reuse a password. One leaked site then opens every account that shares it.
- Turn on two-factor login for email and banking, so a stolen password alone is not enough.
- Let a password manager remember them, so every one can be long and random.
How to check your password strength
- Type or paste a password into the box. The result updates with every key.
- Read the two crack times and the list of problems. Each problem says what an attacker would try and how to fix it.
- If the rating is below Strong, make it longer before making it stranger: a few more random words or characters help more than swapping letters for symbols. Or make a new one with Password Generator.
Frequently asked questions
Is it safe to type my real password here?
The check runs in your browser and the password is never sent anywhere; you can switch off your internet after the page loads and it still works. Even so, the safest habit is to test a password that is similar to yours rather than the real one.
What do the two crack times mean?
Online is someone guessing at a login page that slows them down, about 100 guesses an hour. Offline is someone who has stolen a site's password database and guesses on their own computers, around 100 billion guesses a second for a fast hash. The offline time is the one that matters when a site gets breached.
Why is my long password rated weak?
Attackers do not guess letter by letter. They start with leaked passwords, names, words with symbols swapped in (P@ssw0rd), keyboard runs (qwerty) and years. A password built on those is found long before its length would suggest.
How does it score a passphrase?
Words separated by spaces or hyphens are counted as words picked from a 7,776-word list, which is how a random passphrase is made. Four random words is about 52 bits, six is about 78. Words you chose yourself, like a song lyric, are weaker than that.
Does it check if my password was leaked?
Not against a full breach database, since that would mean sending something about your password over the internet. It does catch the most common leaked passwords. If you used a password on a site that was breached, change it.