Password tester · runs locally
Password Strength Checker
A free password tester that shows how an attacker would actually guess your password - common words, patterns, dates - and how long it would take. Nothing you type is sent anywhere.
Start typing to see how an attacker would guess your password.
Your password is analysed in your browser. It is never sent, logged or stored. Verify it
How Secure Is My Password? What This Tester Measures
Most password strength meters count character types: one uppercase, one number, one symbol, done. That is why P@ssw0rd1! often shows as "strong" - and why it falls in seconds to a real attack. Attackers do not try every combination in order; they start with leaked passwords, dictionary words, names, dates and keyboard patterns, then apply the substitutions people use.
This password strength checker models that. To answer "how strong is my password?" it looks for:
- Common passwords and words from about 49,000 of the most-used passwords and 56,000 common English words, in any capitalization, reversed, or with l33t substitutions (@ for a, 0 for o, $ for s).
- Names and the 7,776 diceware words, so a passphrase is rated by its words, not by its letters.
- Sequences and repeats such as abcd, 9876, aaaa or abcabc.
- Keyboard walks such as qwerty, asdf or 1qaz2wsx.
- Dates and years: 1990, 12/25/1990, 250690.
It then finds the cheapest way to cover your whole password with those pieces plus brute force for whatever is left, and reports the estimated number of guesses. That number drives the crack times for each attacker, and the breakdown panel shows exactly which parts of your password an attacker would guess first.
Common Password Check: The Passwords Attackers Try First
Every password you test is compared against the common-password list that ships with zxcvbn-ts - 49,233 passwords that appear most often in leaked password data. Near the top: 123456, password, 12345678, qwerty, dragon. Every cracking tool tries these first, so a password on this list offers essentially no protection, whatever its length or symbols.
The list is downloaded once from our own server, together with the estimator, when you first click into the field, and searched in your browser. Unlike breach-lookup services, nothing about your password - not even a partial hash - is sent to any server. The check also catches the obvious variations: Password, PASSWORD, p@ssw0rd and drowssap are all recognised as the same weak password.
Two honest limits. First, not being on the list does not make a password strong - a name plus a year is not on it but is still weak, which the pattern analysis catches. Second, the list cannot know about passwords that leaked together with your email address. If you have reused a password anywhere, change it everywhere.
The Most Common Passwords
These are the 20 most common passwords in the list the checker uses. If yours is here - or is one of these with a capital letter or a symbol swapped in - change it now, starting with your email account.
123456password12345678qwerty1234567891234512341111111234567dragon123123baseballabc123footballmonkeyletmeinshadowmaster696969michael
The checker covers the whole list of 49,233, well past the top 10,000, and shows the position of any match: type dragon and it reports common password #10.
Where the list comes from: zxcvbn-ts builds it from the 10 million passwords that Mark Burnett published in 2015, collected from public leaks. Its build script lowercases every password, keeps those used more than 10 times and drops the few that its pattern checks (number runs, keyboard rows) would guess even sooner - those are still flagged, just as patterns. So the rank is the position in that list, not a count from a newer leak.
Password Strength Meter Levels Explained
The rating uses the same scale as every tool on this site, based on the estimated number of guesses expressed in bits (log2 of guesses):
| Rating | Bits | What it means |
|---|---|---|
| Very weak | 0 - 27 | Falls to an offline GPU attack in seconds or less, and often to plain guessing. Replace it. |
| Weak | 28 - 35 | Survives a few online guesses, but not a leaked, fast-hashed database. |
| Fair | 36 - 59 | Takes hours to years offline against a fast hash. Acceptable only with two-factor authentication. |
| Strong | 60 - 79 | Takes centuries or more offline against a fast hash. Fine for most accounts. |
| Very strong | 80+ | Beyond any foreseeable brute-force attack. Use this level for email, banking and your password manager. |
How a site stores your password decides which attacker speed applies to you - and you usually cannot know, so plan for the worst case: a leaked database with a fast hash.
Why Entropy and Guessability Differ
The entropy calculator and the generators on this site compute exact entropy: the size of the space a password was drawn from at random. This checker answers a different question - how guessable is a password a person chose - by looking for the patterns people use.
For a human-chosen password, entropy wildly overstates strength. Summer2026! has 11 characters from all four classes, 72 bits by naive character-set entropy, but the estimator finds a season word plus a few characters and puts it at about 23 bits of real guessing work.
For a randomly generated password it is the other way round. The estimator, finding no pattern, conservatively assumes about 10 options per character, so a random 16-character password scores 53 bits here while its true strength is 105 bits. That is why the generators never use this estimator: for output that really is random, exact entropy is the right measure, and this checker is for passwords people made up.
How to Fix a Weak Password
- Don't tweak it - replace it. Adding a "!" or changing a 1 to a 2 is exactly the mutation cracking rules try. Start over with a random password.
- Go long. 16 random characters, or 5-6 random words from the passphrase generator if you must remember it.
- One password per account. Reuse turns one breach into many. A password manager makes this painless.
- Turn on two-factor authentication for email, banking and social accounts. It protects you even when a password leaks.
Password Strength Checker FAQs
Is it safe to type my real password into this password tester?
The password is analysed entirely in your browser; the page sends no request containing it, and nothing is stored, logged or put in the address bar. You can confirm this by going offline after the checker has loaded - it still works. Even so, a good habit is to test a password of the same style rather than the exact one. How to verify.
How is the crack time calculated?
The checker estimates how many guesses an attacker using dictionaries and pattern rules would need, then divides by a guessing speed: from 100 per second for a rate-limited online attack to 1000 billion per second for a large GPU cluster. The headline figure uses a GPU rig against a fast hash (100 billion per second), the realistic worst case after a breach.
Why does my password with symbols score as weak?
Because symbols in predictable places do not help. "P@ssw0rd1!" is a common password with standard substitutions and a symbol on the end - cracking tools try exactly that, which is why it scores 14 bits here. Length and randomness matter far more than character types.
What does "est. guesses" mean?
It is the estimated number of attempts an attacker would make before hitting your password when trying the most likely candidates first. The bits figure is the same number on a log-2 scale: 40 bits is about a trillion guesses.
Does this check if my password was in a data breach?
It checks against about 49,000 of the most common passwords from public breaches, locally. It does not query breach databases with your password or email, so it cannot tell you whether your specific account leaked.
How strong is strong enough?
Aim for "Very strong" (80+ bits) for your email, bank and password manager, and at least "Strong" (60+ bits) plus two-factor authentication for everything else. A random password of 16 characters or a 6-word passphrase clears the bar.
Is this strength meter the same as zxcvbn?
Yes - it runs zxcvbn-ts, the maintained TypeScript port of Dropbox's zxcvbn, served from this site. To keep the download near 400 KB we load the common-password, diceware, common-English-word and first-name dictionaries and leave out the large last-name and Wikipedia lists, so scores can differ slightly from other zxcvbn tools. Our rating bands are the same ones used by every tool on this site.
Why does a random password I generated score lower than its entropy?
When no pattern matches, the estimator assumes only about 10 options per character, to stay safe for strings a person made up that merely look random. A truly random password from our generator is stronger than that: a 16-character one scores 53 bits here but has 105 bits of character-set entropy, which is the right measure for generated passwords. The checker says so when it finds no pattern.
Should I change passwords regularly?
Not on a schedule. Current NIST guidance says to change a password when there is evidence it was compromised, not every 90 days, because forced rotation leads to predictable patterns.
Related tools