Password Strength Checker
See how fast a password could be cracked, and why. Runs in your browser.
About this password strength checker
This password strength checker estimates how many guesses it would take to crack a password, and shows exactly which parts make it weak. It is for anyone choosing a new password, and for developers who want to see how a realistic strength meter behaves.
It uses zxcvbn, an open-source model first built at Dropbox, with English and common-password dictionaries. You get a score from 0 to 4, crack times for four attack scenarios, a warning, suggestions, and a breakdown of every dictionary word, date, sequence or keyboard walk it found.
Your password is checked inside this page and is never stored or sent. The field stays masked unless you press Show, and the pattern breakdown is masked too.
Features
Pattern-based score, not a checklist
"P@ssw0rd123" ticks every box on a typical meter and still scores 1 out of 4 here, because zxcvbn spots the common password behind the letter swaps.
Crack time for four attacks
Throttled online, unthrottled online, offline slow hash and offline fast hash, each with its guess rate spelled out.
See what the attacker sees
The password is split into the chunks zxcvbn matched: dictionary words with their rank, dates, repeats, sequences, keyboard patterns and random-looking parts.
Your personal details
Add names, birthdays or a pet's name. Passwords that contain them drop in score, just as they would against a targeted guess.
Readable numbers
Guess counts like "15.8 million" and times like "317 million years" instead of a bare "centuries".
Private by design
The dictionaries load into the page once. After that, every check runs on your device with no network request.
How to use the password strength checker
- 1Type a password. It stays hidden unless you press Show.
- 2Read the score, warnings and time to crack for four attack types.
- 3Check which parts matched dictionaries, dates or keyboard patterns, then fix them.
When to use it
Before you set a new password
Test the pattern you have in mind. If it scores 2 or lower, follow the suggestion and test again.
Explaining password advice
Show a colleague why "Summer2024!" only scores 2 of 4: the breakdown flags "Summer" as a common season word, so the rest is all the protection it has.
Checking a generated password
Paste output from the random password generator to confirm it reaches a score of 4.
How is password strength calculated?
Most meters count character types: one uppercase, one digit, one symbol, done. Attackers don't guess that way. They start with leaked password lists, dictionary words, names, dates and keyboard runs like qwerty, then try common tweaks such as a capital first letter or @ for a.
zxcvbn copies that approach. It finds every pattern in the password, estimates how many guesses each part needs, and picks the cheapest way to build the whole thing. The total guess count sets the score: under 1,000 guesses is a 0, under a million is a 1, under 100 million is a 2, under 10 billion is a 3, and anything above that is a 4.
That is why "correct horse battery staple" scores 4 with only lowercase letters and spaces, while "qwertyuiop", ten characters long, scores 0.
What do the crack time scenarios mean?
The same password can last centuries or seconds, depending on how it is attacked. The tool shows four cases.
- Online, rate-limited (100 guesses per hour): someone typing guesses into a login that locks or slows after failures.
- Online, no rate limit (10 per second): a poorly protected login page.
- Offline, slow hash (10,000 per second): a leaked database stored with a slow hash such as bcrypt, scrypt or Argon2.
- Offline, fast hash (10 billion per second): a leaked database of unsalted MD5 or SHA-1 hashes attacked with GPUs. You can see how fast those hashes are with the hash generator.
Why doesn't this tool check Have I Been Pwned?
Breach lookups send part of your password's SHA-1 hash to a server. The k-anonymity method behind them is well designed and only sends 5 hex characters, but it is still a network request carrying data derived from your password.
This site never makes network requests from its tools, and its security policy blocks them. So the dictionaries here include the most common leaked passwords, which catches most reused classics. For a full breach check, use your password manager's built-in breach report.
What makes a password strong?
Length and randomness. A password nobody chose is far stronger than a clever one somebody did. Four or five random words, or 16 random characters, both clear a score of 4 easily. NIST SP 800-63B also recommends long passphrases over composition rules and says to check new passwords against known-breached lists.
Reuse is the bigger risk. A strong password used on ten sites is only as safe as the weakest of those ten.
Why use Mavros
| Mavros | Typical upload sites | |
|---|---|---|
| How strength is judged | Patterns and guess count (zxcvbn) | Counts character types |
| Crack time | Four attack types with guess rates | One number, or none |
| Why it's weak | Each matched word, date or pattern listed | "Add a symbol" |
| Personal details | Optional names and dates lower the score | Not supported |
| Privacy | Checked on the page, never sent or stored | Sometimes sent to a server |
Tips
- Don't add 1 or ! to the end. Attackers try those first, and the score barely moves.
- Use a password manager and let it create a different random password for every site.
- If you'd rather not type your real password, test one with the same structure, such as a different word in the same position.
- Encrypting a file with a password? The password is the weak link, so check it here before you use the AES encryption tool.
Questions
Is it safe to type my password into a strength checker?
Here, yes. The check runs only in your browser, nothing is stored, and the page makes no network request with your password. On any site you don't trust, test a similar password instead of the real one.
What is a good password strength score?
Aim for 3 or 4 out of 4. A score of 3 needs over 100 million guesses and a 4 needs over 10 billion. Scores of 0 to 2 can fall in minutes if a database using a fast hash leaks.
How long would it take to crack my password?
It depends on the attack. The tool shows four times, from a rate-limited login at 100 guesses an hour to a GPU attack on fast hashes at 10 billion a second. Plan for the offline cases.
Why is my long password rated weak?
Because length alone doesn't help if the parts are predictable. Repeated words, keyboard runs, dates and common phrases are cheap to guess. The breakdown shows which chunk is pulling the score down.
What is zxcvbn?
zxcvbn is an open-source password strength estimator, first released by Dropbox in 2012. This tool uses the maintained TypeScript version with English and common-password dictionaries.
Does this check if my password was in a data breach?
Not directly. A breach lookup needs a network request, and this tool makes none. The built-in list of common leaked passwords catches the most reused ones, but use your password manager's breach report for a full check.
Is a passphrase better than a complex password?
Usually, yes. Four or five randomly chosen words are easier to remember and still need trillions of guesses. The key is that the words are picked at random, not a phrase or song lyric.