How to use the password strength checker
- Type or paste into Password to test. The eye button shows or hides it. Until you type, the page shows the example
Summer2024!. - Read the rating, from Very weak to Very strong, and the bits figure, the base 2 logarithm of the estimated guesses.
- In Estimated time to guess it, compare four attacks, from a rate-limited login to a stolen database.
- Use Weak spots, Patterns found and Quick checks to see what an attacker would exploit, then edit and watch the numbers move.
How the estimate works
The old entropy formula (length times the log of the character pool) rates P@ssw0rd at about 53 bits even though every cracking list contains it. This tool loads zxcvbn 4.4.2 instead, the estimator Dropbox described at USENIX Security 2016. It splits a password into pieces, matches each against lists of common passwords, words, names, keyboard patterns, repeats, sequences and years, and counts the guesses an attacker would need. Dividing by guesses per second gives each time: 100 an hour for a rate-limited login, 10 a second for an open one, 10,000 a second against slow hashes such as bcrypt, 10 billion a second against fast hashes such as MD5. The rating is this tool's own: Very weak under 106 guesses, Weak under 109, Fair under 1012, Strong under 1015, Very strong above. The script loads when you click the box, and your password is never part of a request.
Worked example
Before you type anything, the tool shows Summer2024!. zxcvbn reads it as a common password, Summer, followed by 2024!, which it counts as five unpatterned characters. That is about 27,610,000 guesses, or about 25 bits: Weak. The table shows 31 years for a rate-limited online attack, 32 days with no limit, 46 minutes against a slow hash and less than a second against a fast one. Quick checks fail on length (11 characters) and on the year 2024.
Limits and edge cases
- It is an estimate. The word lists date from 2017 or earlier, so recent trends are under-counted, which is why four-digit years are flagged separately.
- Characters with no pattern count as 10 likely choices each, which is cautious. When no pattern is found, the page also shows the figure for truly random characters, as a password manager produces.
- Only the first 50 characters are scored, because the method slows sharply on long input. If the script cannot load, a basic length and character-type estimate appears, labeled as basic.
- It cannot know your name or birthday, or whether the password appeared in a breach, which makes it unsafe at any score. Check addresses at Have I Been Pwned.
- To make a new one, use the password generator. To see how hashes work, try the hash generator.
Frequently asked questions
How long should a password be?
NIST SP 800-63B-4 sets the floor at 15 characters when a password is the only login factor, and 8 when it is paired with multi-factor authentication. The quick check uses 12 as a practical middle. Longer is better, and four or more unrelated random words are easy to remember and hard to guess.
Is it safe to type my real password here?
The check runs in your browser and the password is not part of any request, which your browser's network tab will confirm. A safer habit is to test a password of the same shape, then clear the box.
Why is a password with symbols and numbers rated weak?
Cracking tools already try swaps such as @ for a and 0 for o, capital first letters and trailing numbers. Length and unpredictability add far more strength, and NIST advises against composition rules such as requiring a symbol.
What does time to guess mean for my accounts?
The fast-hash row applies only after a site's password database is stolen and its passwords were stored with a fast hash. Most large sites use slow hashes, closer to the 10,000 guesses a second row.
Sources: NIST SP 800-63B-4, section 3.1.1.2; Wheeler, "zxcvbn: Low-Budget Password Strength Estimation", USENIX Security 2016.