Password Strength
Check password strength with zxcvbn. Realistic crack-time estimates, pattern warnings.
zxcvbnStrengthClient-sideFree to use
How to use
- Type a password. Analysis updates live.
- Read the verdict. Score 0–4, crack-time estimate, suggestions.
Common use cases
- Auditing user passwords
- Learning password best practices
- Comparing password options
Frequently asked questions
- What does the score actually measure?
- The score (0 to 4) combines estimated entropy with pattern detection. Length contributes the most to entropy, but patterns like keyboard walks (qwerty, 12345), repeated characters, and dictionary words are penalised because attackers try those first. A short string with symbols can score lower than a long string with none.
- Why does my "clever" substitution like p@ssw0rd score so low?
- Substitution patterns (@ for a, 0 for o, 3 for e) are extremely well-known and are the first things modern password crackers try. The scorer models this explicitly, so p@ssw0rd scores nearly as low as "password" itself. A longer random passphrase of unrelated words is far stronger.
- Does this tool send my password to a server?
- No. All scoring runs in your browser. The password you type is never transmitted anywhere.
- How accurate are the crack-time estimates?
- They are realistic estimates based on heuristics similar to the zxcvbn library, not guarantees. The estimates assume an attacker with a modern GPU rig running optimised cracking software. Real-world security depends on many factors the checker cannot see, such as whether the password has appeared in a data breach.
- What is the fastest way to get a strong password?
- Pick four or more random, unrelated words and concatenate them into a passphrase. Length is the dominant factor in entropy, and a passphrase like "correct horse battery staple" is both memorable and far stronger than a short symbol-laden string.
Related tools
How to use
- Type a password. Analysis updates live.
- Read the verdict. Score 0–4, crack-time estimate, suggestions.
Common use cases
- Auditing user passwords
- Learning password best practices
- Comparing password options
Frequently asked questions
- What does the score actually measure?
- The score (0 to 4) combines estimated entropy with pattern detection. Length contributes the most to entropy, but patterns like keyboard walks (qwerty, 12345), repeated characters, and dictionary words are penalised because attackers try those first. A short string with symbols can score lower than a long string with none.
- Why does my "clever" substitution like p@ssw0rd score so low?
- Substitution patterns (@ for a, 0 for o, 3 for e) are extremely well-known and are the first things modern password crackers try. The scorer models this explicitly, so p@ssw0rd scores nearly as low as "password" itself. A longer random passphrase of unrelated words is far stronger.
- Does this tool send my password to a server?
- No. All scoring runs in your browser. The password you type is never transmitted anywhere.
- How accurate are the crack-time estimates?
- They are realistic estimates based on heuristics similar to the zxcvbn library, not guarantees. The estimates assume an attacker with a modern GPU rig running optimised cracking software. Real-world security depends on many factors the checker cannot see, such as whether the password has appeared in a data breach.
- What is the fastest way to get a strong password?
- Pick four or more random, unrelated words and concatenate them into a passphrase. Length is the dominant factor in entropy, and a passphrase like "correct horse battery staple" is both memorable and far stronger than a short symbol-laden string.