Password Strength Checker

How long does it take to crack a password?

Crack time is the number of guesses an attacker needs divided by how fast they can guess. The guess count comes from the password's patterns; the speed depends on where the attack happens. The table shows the four rates this checker uses for a few guess counts.

Time to crack by guesses needed and attack type

Guesses needed	Online, rate-limited (100/hour)	Online, no limit (10/s)	Offline, slow hash (10,000/s)	Offline, fast hash (10 billion/s)
106 (score 1-2)	about 1 year	about 1 day	about 2 minutes	instant
108 (score 3)	about 114 years	about 116 days	about 3 hours	instant
1010 (score 4)	centuries	about 32 years	about 12 days	about 1 second
1012	centuries	centuries	about 3 years	about 2 minutes
1014	centuries	centuries	centuries	about 3 hours

The last column is the one to plan for. If a site stores passwords with a fast hash and its database leaks, anything under about 10¹⁴ guesses falls within a day on cracking hardware.

What makes a password strong or weak?

Unpredictability, not decoration. Attackers start with leaked password lists, dictionary words, names, keyboard walks, dates and common substitutions, then combine them. A password built from those pieces needs few guesses even when it mixes cases, digits and symbols. Length made of unrelated parts, such as four random words or a generated string, raises the guess count fast.

How does this password strength checker work?

It runs zxcvbn, the open-source strength estimator also used by password managers. The password is matched against common passwords, English words and first names, keyboard layouts, repeated characters, sequences, dates and recent years, including reversed words and letter swaps like 3 for e. The checker finds the cheapest way to build the password from those pieces and reports the total guesses, a score from 0 to 4, a warning, suggestions and each pattern it found.

The word lists load the first time you type, from this site, and never include your password. Analysis covers only the first 100 characters. The result does not assess any remaining characters or guarantee that a longer password is safe.

What do the four attack scenarios mean?

Online, rate-limited is someone typing guesses into a login that locks or slows after failures. Online, no rate limit is a login with no lockout. Offline, slow hash is a stolen database protected with bcrypt, scrypt or Argon2, where each guess is deliberately expensive. Offline, fast hash is a stolen database with MD5, SHA-1 or a similar fast hash, attacked with GPUs. You rarely know how a site stores passwords, so the fast-hash row is the safe assumption.

Which weak patterns does the checker detect?

Detected patterns show each piece and its type: common word or password, word with letter swaps, reversed word, keyboard pattern, repeated characters, sequence (abc, 123), date, and recent year. Each one shrinks the guess count, so remove the piece rather than adding a symbol to it.

How can you make your password stronger?

Use a different password for every account, stored in a password manager, so one leak cannot unlock the others. For passwords you must remember, join four or more random words; for everything else, use the Password Generator. Turn on two-factor authentication wherever it is offered. A strong score does not tell you whether a password has already leaked, so change any password you reused on a site that was breached.