Password strength checker
Type a password and this page tells you two things: how quickly an attacker who knows human habits would guess it, and how strong a password of the same length and characters would be if a generator had made it. Tell it how the password was made, and it shows which answer applies to you.
Length must be 1 to 128.
on average
Neither number is a security guarantee. Both are outputs of a named model under a stated assumption.
This figure is this page's own arithmetic: length × log2(character set size). zxcvbn-ts is not used for it.
This page does not know where your password came from, so it scores it the way an attacker must: against the whole 94-character printable-ASCII space. The password generator knows the alphabet it drew from, so it reports fewer bits for the very same password. Both numbers are right, because they answer different questions.
0 third-party scripts on this page
KB figures are compressed transfer size, not decoded size.
This page does not make passwords.
- Guessability
- ·
- If fully random
- ·
- Length
- ·
- Network requests
- ·
- Our own script
- ·
Was this tool useful?
Why one number would be a lie
Entropy is a property of the process that produced a secret, not of the string it produced. Nothing looking at the characters can tell the two cases apart.
Take a passphrase of four words joined by hyphens. Drawn at random from a 2,048-word list, it is 44 bits and perfectly respectable. Typed by a person because they read the famous comic about it, it is worth close to nothing, because that exact string has been in every cracking wordlist for over a decade. Identical characters, identical length, identical character classes. One is fine and one is already broken.
The generated figure is an upper bound and is correct only when a generator really did the work. The second figure estimates how many guesses a pattern-aware attacker may need. It is produced by zxcvbn-ts, an MIT-licensed maintained engine, and remains a model rather than a measurement of the password's entropy. The matcher does not always split a passphrase on every space, so the "Why the score fell" list can name fewer words than you typed. It does not invent the missing ones.
What the chosen estimate looks for
A dictionary word is worth roughly the logarithm of the wordlist, not its length. An attacker guesses words, not letters, so an eight-letter word from a common list is about eleven bits rather than the thirty-seven its length implies.
Replacing letters with lookalike digits is the first rule every cracking tool applies, so it earns about two bits rather than the twenty it appears to. A trailing year is worth under seven bits, because there are about a hundred plausible ones. Capitalizing only the first letter is what almost everyone does. Keyboard runs, repeated characters and straight sequences are all in the standard wordlists.
The local engine also checks its official common-password corpus and keyboard graphs. Finding no familiar structure is still not proof of randomness: real attackers use breach corpora, regional dictionaries, and rules no browser bundle can completely reproduce.
What to do with the number
Under 40 bits, assume it is already crackable if a database holding it is ever stolen. Between 40 and 60, it survives an unsophisticated attack and not a determined one. Above 70 bits, an offline attack stops being the thing to worry about, and the realistic risks become reuse across sites, phishing, and the password being in a breach somewhere with your email next to it.
Those last three are not measurable from the characters, and they are how most accounts are actually lost. A strong password used in two places is weaker than a mediocre one used in one.
Questions
How long would it take to crack my password?
This page gives two answers. The first estimates how fast a cracker who knows human habits would guess it, shown at 10,000 and at 100 billion guesses a second. The second shows what a password of the same length would be worth if a generator had drawn it from all 94 printable characters. The page tells you which one applies.
How long does it take to crack a password by length?
Switch to Score a shape and set the length. With all four character types, 8 characters is 52.4 bits, which takes about 8 hours on average at 100 billion guesses a second. 12 characters is 78.7 bits, about 75,000 years on average. 16 is 104.9 bits. Those times assume the password was random. A chosen one falls much sooner.
Why does length matter more than symbols?
Each extra character multiplies the number of guesses by the size of the alphabet. Adding symbols grows the alphabet from 62 to 94, worth about 0.6 bits per character. One more character is worth about 6.55 bits. So adding length does far more than adding symbols.
What counts as a good score?
The page prints one of five labels, from Very guessable to Very resistant. That label is for a password you chose. For a password a manager types, look at the generated figure instead and aim for over 100 bits. On this page's 94-character count, 16 characters gives 104.9 bits. The password generator uses 75 characters, so it needs 17 characters (105.9 bits) to clear 100. For one you'll type yourself, a generated passphrase is easier to remember than anything you'd invent.
Does it check whether my password has been in a breach?
No. A breach check usually works by sending part of a hash of your password to a remote service, and this page sends nothing. It does check your password against a built-in list of common passwords, right here in the tab. For a breach check, use your password manager's.
Is my password sent anywhere?
No. The estimate runs in this tab, it keeps working with the network off once the page has loaded, and an automated check confirms that before every update goes live. Still, type a variation, not the real thing. Pasting real passwords into web pages is a habit worth dropping.
Related tools
If the answer is that yours is too weak, the password generator makes one with the entropy printed, and the passphrase generator makes one you can actually type. Generating either in this tab is the subject of is it safe to use an online password generator. To fingerprint a value rather than judge a secret, use the hash generator.