Password Strength Checker

How to check a password

1. Type or paste the password in Password to test. The field hides what you type; press Show to see it, and Hide to mask it again.
2. The result appears as you type. The Strength bar goes from 0 (Very weak) to 4 (Very strong).
3. Read the Estimated time to crack table: it gives one duration for each of four attack scenarios, from a website that limits login attempts to a stolen database attacked with graphics cards.
4. Check Weaknesses and tips. It names the problem the checker found (a common password, a keyboard pattern, a date, a repeated sequence…) and suggests how to fix it.

The password is analyzed only in this page. It is never sent, saved or logged, and the field is cleared when you leave the page. Even so, the safest habit is to test a password that looks like yours rather than your real one.

How the score is calculated

This tool uses zxcvbn, an open-source password estimator originally created at Dropbox (here in its maintained TypeScript version, zxcvbn-ts). Instead of counting uppercase letters and symbols, it thinks like a password cracker. It splits the password into pieces and looks for patterns that attackers try first:

• the most common leaked passwords, first names, last names and frequent English and French words, including reversed words and “l33t” substitutions such as p@ssw0rd;
• keyboard walks such as qwerty, azerty or 1qaz2wsx;
• repeated characters (aaaa), repeated blocks (abcabc) and sequences (abcd, 9876);
• dates and recent years.

It then estimates how many guesses an attacker would need to find the whole password, shown as Estimated guesses. The score follows that number: under a thousand guesses gives 0, under a million 1, under 100 million 2, under 10 billion 3, and anything above scores 4.

The four attack scenarios

The crack times divide the estimated number of guesses by the speed of each attack:

An online attack means someone types guesses into a login form. An offline attack happens after a data breach, when the attacker has a copy of the stored password hashes and can test guesses on their own hardware. The last line is the worst case, and it is the one to watch for passwords that protect email, banking or a password manager. The times are averages: an attacker may get lucky sooner.

Entropy estimate

The Entropy estimate is the classic brute-force figure: length × log2(pool size), where the pool is the sum of the character types used (26 lowercase, 26 uppercase, 10 digits, 33 symbols, and 100 for other characters such as accents or emoji). Qwerty123! gets about 66 bits by this formula, yet zxcvbn scores it 0 (Very weak) because it is a keyboard row followed by a common suffix. Entropy is only meaningful for passwords picked at random, for example by a password generator; for human-made passwords, trust the score and crack times.