Check password strength locally, nothing sent

How to use this tool

Type or paste your password. Enter the password in the field. The strength bar updates in real time as you type.
Review the score and entropy. The label (Very Weak to Very Strong) and entropy estimate show you where the password stands. Aim for Strong or Very Strong.
Read the suggestions. Any warnings and specific improvement tips appear below the bar. Follow them to raise the score.
Check crack times. The table shows estimated average time to crack under four realistic attack speeds - from throttled online logins to offline GPU attacks against a fast hash.

How password strength is measured

This tool uses two complementary approaches. First, it estimates entropy: the number of bits of unpredictability based on the character classes present (lowercase, uppercase, digits, symbols) and the length of the password. It treats any non-alphanumeric character as a 32-character symbol pool. Under the model, a 16-character password drawn uniformly from lowercase letters, uppercase letters, digits, and common printable symbols would have about 105 bits. That is a mathematical estimate, not a guarantee: the checker cannot know how a password was chosen or whether its characters were random.

Second, it checks for patterns that attackers test first: common passwords (like "password123"), repeated characters ("aaaa"), sequential runs ("1234", "abcde"), and keyboard walks ("qwerty"). A password that looks long but is built from one of these patterns is far weaker than the raw entropy estimate suggests, so the score is adjusted downward.

Understanding the crack time estimates

The four attack scenarios illustrate different attacker conditions:

Online throttled (100/s): most web services limit login attempts to a few per second. An attacker guessing your password over the public internet faces this limit.
Online unthrottled (10,000/s): some services have looser rate limits, or the attacker can spread attempts across many IPs.
Offline slow hash (10M/s): if a database is stolen, attackers work locally. Bcrypt and Argon2 are slow by design; this scenario assumes that protection is in place.
Offline fast hash (10B/s): the worst case: the hash is MD5, SHA-1, or an unsalted SHA-256. Modern GPU rigs can try billions of passwords per second.

The estimates show average time (half the modeled search space). Actual service rate limits, hash algorithms and parameters, salts, and attacker hardware vary, so these figures are rough comparisons rather than predictions.

Detected patterns lower the strength score, but they do not adjust the crack-time table. Its times use the raw entropy estimate and can be especially optimistic for a predictable password.

Why patterns matter more than length

A 12-character password like "Qwerty123!!!" is technically in the "complex" category (upper, lower, digits, symbols), but it would be cracked almost immediately because it's a predictable keyboard pattern. Attackers maintain wordlists of millions of such patterns and test them before trying brute force. A random 8-character password from all four classes is often stronger in practice than a patterned 12-character one.

What to do if your password is weak

The suggestions panel gives specific, actionable advice. The most impactful changes are, in rough order: avoid common passwords and patterns, then choose a longer password generated at random or a multiword passphrase. This heuristic gives higher estimates when more character classes appear, but character variety is not a universal requirement. Use the Password Generator if you want a cryptographically random replacement, or the Passphrase Generator if you need something memorable.

How this custom estimate works

This checker does not use Dropbox's zxcvbn algorithm. It uses a small, custom browser heuristic: it estimates a character pool from the lowercase, uppercase, digit, and non-alphanumeric classes in the input, multiplies the pool's base-2 logarithm by the length, and applies penalties for a small built-in common-password list and a few simple patterns.

A match against the built-in common-password list.
Runs of repeated characters, such as "aaaa".
Short ascending or descending sequences, such as "123" or "cba".
A limited set of keyboard walks, such as "qwerty" or "asdfg".

It does not analyze broad word dictionaries, names, dates, or letter substitutions such as "p@ssw0rd". It may miss predictable passwords and can overestimate their resistance. Use the score as a quick local signal, not as a security audit or proof that a password is safe.

Checking passwords against breach data

This tool does not check breach data and does not contact HIBP. If you choose to use the Have I Been Pwned Pwned Passwords service , its range API can use k-anonymity: a client sends a five-character SHA-1 hash prefix and compares the returned suffixes locally. That still makes a network request to an external service. Review its privacy information before submitting a sensitive password.

A password found in breach data should be replaced even if a strength estimate looks high. For real accounts, avoid reusing passwords and use a password manager to create unique ones.

Frequently asked questions

Is my password sent anywhere?

The strength analysis runs in your browser, and typing does not send the password to a strength or breach-checking service. This page does not make HIBP requests. The checker does not save the password.

How is password strength calculated?

This page uses a custom browser heuristic, not Dropbox zxcvbn. It estimates entropy from the character classes present and password length, then applies checks for a small built-in list of common passwords, repeated characters, sequences, and a few keyboard walks. It does not recognize broad dictionaries, dates, or letter substitutions, so treat its score as a rough guide.

Why does my long password score lower than expected?

Common keyboard patterns ("qwerty123"), sequential runs ("1234abcd"), or heavy repetition ("aaaabbbb") are penalized because they are predictable. The rules are intentionally simple and can miss patterns such as names, dates, and common word substitutions. Prefer a long, randomly generated password or passphrase; adding symbols alone does not make a predictable password safe.

What does "entropy" mean for a password?

Entropy is a mathematical estimate in bits. This checker assumes each character was chosen independently and uniformly from the detected character pool, then estimates an average search of about 2^(bits-1) guesses. Real passwords often contain patterns that violate that assumption, so the number is not a guarantee or a security threshold.

Which attack speed should I care about?

Online and offline rates illustrate very different attacker conditions. Real login limits vary by service. Offline speeds depend on the stolen hash algorithm, its parameters, salts, and attacker hardware; the MD5 row is a fast-hash example, not a prediction for every breach. Use these times only as rough comparisons.