Password Strength Checker
Real-world password strength checker powered by Dropbox's zxcvbn. Shows entropy, crack time across four attack scenarios, detected patterns (dictionary words, keyboard walks, dates, repeats), and actionable improvement suggestions.
100% local processing. The password never leaves your browser — no network requests, no logs.
Waiting for input
How to use
- 1 Type or paste the password you want to test.
- 2 Review the live score, entropy, and crack-time estimates across four attack scenarios.
- 3 Inspect the detected patterns and improvement suggestions to make the password stronger.
Related tools
AES Encrypt Decrypt
Use AES Encrypt Decrypt online for free. Your files and data stay in your browser.
MD5 Hash Generator
Use MD5 Hash Generator online for free. Your files and data stay in your browser.
Password Generator
Use Password Generator online for free. Your files and data stay in your browser.
RSA Key Pair Generator
Use RSA Key Pair Generator online for free. Your files and data stay in your browser.
SHA Hash Generator
Use SHA Hash Generator online for free. Your files and data stay in your browser.
About this tool
This checker is powered by zxcvbn, the password-strength estimator open-sourced by Dropbox and used by banks, SaaS apps, and security teams worldwide. Unlike simple checkers that only count length and character classes, zxcvbn actually parses the password and recognizes the patterns real attackers use: dictionary words, keyboard walks (qwerty, 123456), repeats, dates, leet substitutions (p@ssw0rd), and common sequences.
The tool reports crack-time estimates for four realistic threat models: online throttled (100 attempts/sec, like a login endpoint with rate limiting), online no-throttle (10/sec), offline slow hash (bcrypt at 10k/sec), and offline fast hash (SHA-1 at 10B/sec). A password strong enough for a blog comment may be useless for a crypto exchange, so the multi-scenario view helps you choose strength appropriate to the asset you're protecting.
All computation runs locally in your browser. The password never leaves your device, no network request is made, and results are deterministic and reproducible.
Frequently asked questions
Does this tool store or transmit the password I type? +
No. All scoring runs entirely in your browser. There are zero network requests, and closing the tab erases everything. You can safely test your real passwords here.
How is zxcvbn different from the password strength meter built into my browser? +
Browser-native meters usually only check length and character variety (uppercase, digits, symbols), so they are easily fooled by patterns like P@ssw0rd1 that look complex but are extremely common. zxcvbn recognizes the same patterns attackers actually use — dictionary words, keyboard sequences, leet substitutions, repeats — so P@ssw0rd1 correctly scores as weak here while a naive meter might call it strong.
Why can a 16-character letters-only password sometimes be weaker than an 8-character one with symbols? +
Because strength is about how many guesses an attacker needs, not about character variety. A password like passwordpassword is 16 characters but is just a dictionary word repeated, so it falls in seconds. zxcvbn detects the repetition and scores it accordingly. Length helps only when the characters are unpredictable.
What do the scores 0 through 4 mean? +
0 = very weak (under 10^3 guesses, cracked in seconds). 1 = weak (under 10^6, minutes). 2 = fair (under 10^8, hours). 3 = strong (under 10^10, years even for offline fast-hash attacks). 4 = very strong (over 10^10, infeasible even with dedicated hardware). For banking, email, and password-manager master passwords, aim for 4.
How should I act on the feedback? +
The tool lists every pattern it detected (e.g. 'dictionary word: john', 'keyboard walk: qwerty') along with concrete suggestions. The biggest wins usually come from: avoiding dictionary words and personal info, never reusing a segment, and going longer — a 20+ character random password typically beats an 8-character one with symbols. The best practice is to generate random passwords with a password manager and only memorize the master password.