Password Strength Checker

A password strength checker estimates how resistant a candidate password is to guessing. The widely-used algorithm is zxcvbn, published by Dropbox in 2012 and still the basis for most modern checkers. The tool above runs zxcvbn-style estimation in your browser; nothing about your password leaves your machine.

What strength actually means

Two attacker models matter:

• Online attack. The attacker submits guesses through a normal login form. The system rate-limits, locks accounts after N failures, or otherwise caps guess rate. A few thousand guesses is the practical ceiling.
• Offline attack. The attacker has stolen the password database and is grinding hashes locally. With a slow hash like bcrypt and modern hardware, expect ~10⁴–10⁶ guesses per second per GPU; with a fast hash like a single SHA-256, ~10⁹–10¹¹ per second.

A password that resists offline attack also resists online attack. The interesting question is: how many guesses can the password absorb before being found?

zxcvbn returns an estimate of that number — the guesses field — and bins it into five scores 0–4:

For anything important, score 3+ is the bar. For anything where an offline attack is realistic (your password manager master password, full-disk encryption keys), aim for 4.

Why character-class rules don’t work

The legacy rule “uppercase + lowercase + digit + symbol” assumes the attacker uses brute force across the alphabet. Real attackers don’t — they use dictionaries, leaked-password lists, and pattern-aware crackers like Hashcat with rule files. Against those:

• Password1! satisfies the rule and is in the top 1,000 guesses.
• correct horse battery staple (XKCD 936) violates the rule (no symbols, no digits) and absorbs ~10¹¹ guesses.

zxcvbn scores by guessability, not by character classes. It looks for:

• Common passwords from leak corpora
• Dictionary words (English, names, places, common substitutions like 4 for a)
• Keyboard patterns (qwerty, 1q2w3e, asdf)
• Date patterns (1985, 01/15/2024)
• Repeats (aaaa, abcabc)
• Sequences (abcdef, 123456)

A password gets credit for the bits of randomness not explained by these patterns. That’s why a 25-character all-lowercase phrase outranks an 8-character symbol stew.

What strength meters can’t see

• Whether you’ve used this password elsewhere. A unique 16-character password is high-strength against guessing but low-strength if it leaked from a breached site three years ago. The “have I been pwned” check is independent and orthogonal — a password manager that warns about reused or breached passwords is the answer here, not a strength meter.
• Whether the website’s hashing is good. A 5-bit password is fine if the site enforces 1 attempt per minute and bcrypts the digest. A 30-bit password is bricked the moment the site’s database leaks if they SHA-1 with no salt. Strength is conditional on the system’s defenses, which you can’t see from the client.
• Out-of-band compromise. A keylogger, a phishing site, a malicious browser extension — strength doesn’t help.

Practical recommendation

The advice that cleanly survives the last decade of cryptanalysis:

1. Use a password manager. Generate a long random string per site. Don’t memorize most passwords. Use the password generator for one-off generation.
2. Memorize a small number of high-quality phrases. Your password-manager master, your full-disk encryption, your email account. 4–6 truly random words from a list of ~2,000 common words gives ~44–66 bits — enough.
3. Add a second factor. A hardware key, an authenticator app — anything that doesn’t rely on the password alone.
4. Don’t reuse passwords. Reuse converts a breach of any site into a breach of every site you reused at.

What this checker is for

The tool above is useful for two things: gut-checking a candidate phrase before committing to it, and learning what kinds of patterns zxcvbn flags as weak. It is not a substitute for a password manager, a 2FA setup, or breach monitoring.

For other security-related generators, see the API key generator and the hash generator.